IEMAllCImpl.cpp.h@ 47681

Last change on this file since 47681 was 47598, checked in by vboxsync, 11 years ago
IEM: Fixed sp/esp handling in IRET.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 192.3 KB

Line
1	/* $Id: IEMAllCImpl.cpp.h 47598 2013-08-07 16:59:58Z vboxsync $ */
2	/** @file
3	* IEM - Instruction Implementation in C/C++ (code include).
4	*/
5
6	/*
7	* Copyright (C) 2011-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/** @name Misc Helpers
20	* @{
21	*/
22
23
24	/**
25	* Worker function for iemHlpCheckPortIOPermission, don't call directly.
26	*
27	* @returns Strict VBox status code.
28	*
29	* @param pIemCpu The IEM per CPU data.
30	* @param pCtx The register context.
31	* @param u16Port The port number.
32	* @param cbOperand The operand size.
33	*/
34	static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
35	{
36	/* The TSS bits we're interested in are the same on 386 and AMD64. */
37	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
38	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
39	AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
40	AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
41
42	/*
43	* Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
44	*/
45	Assert(!pCtx->tr.Attr.n.u1DescType);
46	if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
47	&& pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
48	{
49	Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
50	u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
51	return iemRaiseGeneralProtectionFault0(pIemCpu);
52	}
53
54	/*
55	* Read the bitmap offset (may #PF).
56	*/
57	uint16_t offBitmap;
58	VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &offBitmap, UINT8_MAX,
59	pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
60	if (rcStrict != VINF_SUCCESS)
61	{
62	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
63	return rcStrict;
64	}
65
66	/*
67	* The bit range from u16Port to (u16Port + cbOperand - 1), however intel
68	* describes the CPU actually reading two bytes regardless of whether the
69	* bit range crosses a byte boundrary. Thus the + 1 in the test below.
70	*/
71	uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
72	/** @todo check if real CPUs ensures that offBitmap has a minimum value of
73	* for instance sizeof(X86TSS32). */
74	if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
75	{
76	Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
77	offFirstBit, pCtx->tr.u32Limit));
78	return iemRaiseGeneralProtectionFault0(pIemCpu);
79	}
80
81	/*
82	* Read the necessary bits.
83	*/
84	/** @todo Test the assertion in the intel manual that the CPU reads two
85	* bytes. The question is how this works wrt to #PF and #GP on the
86	* 2nd byte when it's not required. */
87	uint16_t bmBytes = UINT16_MAX;
88	rcStrict = iemMemFetchSysU16(pIemCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
89	if (rcStrict != VINF_SUCCESS)
90	{
91	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
92	return rcStrict;
93	}
94
95	/*
96	* Perform the check.
97	*/
98	uint16_t fPortMask = (1 << cbOperand) - 1;
99	bmBytes >>= (u16Port & 7);
100	if (bmBytes & fPortMask)
101	{
102	Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
103	u16Port, cbOperand, bmBytes, fPortMask));
104	return iemRaiseGeneralProtectionFault0(pIemCpu);
105	}
106
107	return VINF_SUCCESS;
108	}
109
110
111	/**
112	* Checks if we are allowed to access the given I/O port, raising the
113	* appropriate exceptions if we aren't (or if the I/O bitmap is not
114	* accessible).
115	*
116	* @returns Strict VBox status code.
117	*
118	* @param pIemCpu The IEM per CPU data.
119	* @param pCtx The register context.
120	* @param u16Port The port number.
121	* @param cbOperand The operand size.
122	*/
123	DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
124	{
125	X86EFLAGS Efl;
126	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
127	if ( (pCtx->cr0 & X86_CR0_PE)
128	&& ( pIemCpu->uCpl > Efl.Bits.u2IOPL
129	\|\| Efl.Bits.u1VM) )
130	return iemHlpCheckPortIOPermissionBitmap(pIemCpu, pCtx, u16Port, cbOperand);
131	return VINF_SUCCESS;
132	}
133
134
135	#if 0
136	/**
137	* Calculates the parity bit.
138	*
139	* @returns true if the bit is set, false if not.
140	* @param u8Result The least significant byte of the result.
141	*/
142	static bool iemHlpCalcParityFlag(uint8_t u8Result)
143	{
144	/*
145	* Parity is set if the number of bits in the least significant byte of
146	* the result is even.
147	*/
148	uint8_t cBits;
149	cBits = u8Result & 1; /* 0 */
150	u8Result >>= 1;
151	cBits += u8Result & 1;
152	u8Result >>= 1;
153	cBits += u8Result & 1;
154	u8Result >>= 1;
155	cBits += u8Result & 1;
156	u8Result >>= 1;
157	cBits += u8Result & 1; /* 4 */
158	u8Result >>= 1;
159	cBits += u8Result & 1;
160	u8Result >>= 1;
161	cBits += u8Result & 1;
162	u8Result >>= 1;
163	cBits += u8Result & 1;
164	return !(cBits & 1);
165	}
166	#endif /* not used */
167
168
169	/**
170	* Updates the specified flags according to a 8-bit result.
171	*
172	* @param pIemCpu The IEM state of the calling EMT.
173	* @param u8Result The result to set the flags according to.
174	* @param fToUpdate The flags to update.
175	* @param fUndefined The flags that are specified as undefined.
176	*/
177	static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
178	{
179	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
180
181	uint32_t fEFlags = pCtx->eflags.u;
182	iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
183	pCtx->eflags.u &= ~(fToUpdate \| fUndefined);
184	pCtx->eflags.u \|= (fToUpdate \| fUndefined) & fEFlags;
185	}
186
187
188	/**
189	* Loads a NULL data selector into a selector register, both the hidden and
190	* visible parts, in protected mode.
191	*
192	* @param pSReg Pointer to the segment register.
193	* @param uRpl The RPL.
194	*/
195	static void iemHlpLoadNullDataSelectorProt(PCPUMSELREG pSReg, RTSEL uRpl)
196	{
197	/** @todo Testcase: write a testcase checking what happends when loading a NULL
198	* data selector in protected mode. */
199	pSReg->Sel = uRpl;
200	pSReg->ValidSel = uRpl;
201	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
202	pSReg->u64Base = 0;
203	pSReg->u32Limit = 0;
204	pSReg->Attr.u = X86DESCATTR_UNUSABLE;
205	}
206
207
208	/**
209	* Helper used by iret.
210	*
211	* @param uCpl The new CPL.
212	* @param pSReg Pointer to the segment register.
213	*/
214	static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
215	{
216	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
217	if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
218	CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
219	#else
220	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
221	#endif
222
223	if ( uCpl > pSReg->Attr.n.u2Dpl
224	&& pSReg->Attr.n.u1DescType /* code or data, not system */
225	&& (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
226	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) /* not conforming code */
227	iemHlpLoadNullDataSelectorProt(pSReg, 0);
228	}
229
230
231	/**
232	* Indicates that we have modified the FPU state.
233	*
234	* @param pIemCpu The IEM state of the calling EMT.
235	*/
236	DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
237	{
238	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
239	}
240
241	/** @} */
242
243	/** @name C Implementations
244	* @{
245	*/
246
247	/**
248	* Implements a 16-bit popa.
249	*/
250	IEM_CIMPL_DEF_0(iemCImpl_popa_16)
251	{
252	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
253	RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
254	RTGCPTR GCPtrLast = GCPtrStart + 15;
255	VBOXSTRICTRC rcStrict;
256
257	/*
258	* The docs are a bit hard to comprehend here, but it looks like we wrap
259	* around in real mode as long as none of the individual "popa" crosses the
260	* end of the stack segment. In protected mode we check the whole access
261	* in one go. For efficiency, only do the word-by-word thing if we're in
262	* danger of wrapping around.
263	*/
264	/** @todo do popa boundary / wrap-around checks. */
265	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
266	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
267	{
268	/* word-by-word */
269	RTUINT64U TmpRsp;
270	TmpRsp.u = pCtx->rsp;
271	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
272	if (rcStrict == VINF_SUCCESS)
273	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
274	if (rcStrict == VINF_SUCCESS)
275	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
276	if (rcStrict == VINF_SUCCESS)
277	{
278	iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
279	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
280	}
281	if (rcStrict == VINF_SUCCESS)
282	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
283	if (rcStrict == VINF_SUCCESS)
284	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
285	if (rcStrict == VINF_SUCCESS)
286	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
287	if (rcStrict == VINF_SUCCESS)
288	{
289	pCtx->rsp = TmpRsp.u;
290	iemRegAddToRip(pIemCpu, cbInstr);
291	}
292	}
293	else
294	{
295	uint16_t const *pa16Mem = NULL;
296	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
297	if (rcStrict == VINF_SUCCESS)
298	{
299	pCtx->di = pa16Mem[7 - X86_GREG_xDI];
300	pCtx->si = pa16Mem[7 - X86_GREG_xSI];
301	pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
302	/* skip sp */
303	pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
304	pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
305	pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
306	pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
307	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
308	if (rcStrict == VINF_SUCCESS)
309	{
310	iemRegAddToRsp(pIemCpu, pCtx, 16);
311	iemRegAddToRip(pIemCpu, cbInstr);
312	}
313	}
314	}
315	return rcStrict;
316	}
317
318
319	/**
320	* Implements a 32-bit popa.
321	*/
322	IEM_CIMPL_DEF_0(iemCImpl_popa_32)
323	{
324	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
325	RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
326	RTGCPTR GCPtrLast = GCPtrStart + 31;
327	VBOXSTRICTRC rcStrict;
328
329	/*
330	* The docs are a bit hard to comprehend here, but it looks like we wrap
331	* around in real mode as long as none of the individual "popa" crosses the
332	* end of the stack segment. In protected mode we check the whole access
333	* in one go. For efficiency, only do the word-by-word thing if we're in
334	* danger of wrapping around.
335	*/
336	/** @todo do popa boundary / wrap-around checks. */
337	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
338	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
339	{
340	/* word-by-word */
341	RTUINT64U TmpRsp;
342	TmpRsp.u = pCtx->rsp;
343	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
344	if (rcStrict == VINF_SUCCESS)
345	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
346	if (rcStrict == VINF_SUCCESS)
347	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
348	if (rcStrict == VINF_SUCCESS)
349	{
350	iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
351	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
352	}
353	if (rcStrict == VINF_SUCCESS)
354	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
355	if (rcStrict == VINF_SUCCESS)
356	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
357	if (rcStrict == VINF_SUCCESS)
358	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
359	if (rcStrict == VINF_SUCCESS)
360	{
361	#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
362	pCtx->rdi &= UINT32_MAX;
363	pCtx->rsi &= UINT32_MAX;
364	pCtx->rbp &= UINT32_MAX;
365	pCtx->rbx &= UINT32_MAX;
366	pCtx->rdx &= UINT32_MAX;
367	pCtx->rcx &= UINT32_MAX;
368	pCtx->rax &= UINT32_MAX;
369	#endif
370	pCtx->rsp = TmpRsp.u;
371	iemRegAddToRip(pIemCpu, cbInstr);
372	}
373	}
374	else
375	{
376	uint32_t const *pa32Mem;
377	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
378	if (rcStrict == VINF_SUCCESS)
379	{
380	pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
381	pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
382	pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
383	/* skip esp */
384	pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
385	pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
386	pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
387	pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
388	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
389	if (rcStrict == VINF_SUCCESS)
390	{
391	iemRegAddToRsp(pIemCpu, pCtx, 32);
392	iemRegAddToRip(pIemCpu, cbInstr);
393	}
394	}
395	}
396	return rcStrict;
397	}
398
399
400	/**
401	* Implements a 16-bit pusha.
402	*/
403	IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
404	{
405	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
406	RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
407	RTGCPTR GCPtrBottom = GCPtrTop - 15;
408	VBOXSTRICTRC rcStrict;
409
410	/*
411	* The docs are a bit hard to comprehend here, but it looks like we wrap
412	* around in real mode as long as none of the individual "pushd" crosses the
413	* end of the stack segment. In protected mode we check the whole access
414	* in one go. For efficiency, only do the word-by-word thing if we're in
415	* danger of wrapping around.
416	*/
417	/** @todo do pusha boundary / wrap-around checks. */
418	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
419	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
420	{
421	/* word-by-word */
422	RTUINT64U TmpRsp;
423	TmpRsp.u = pCtx->rsp;
424	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
425	if (rcStrict == VINF_SUCCESS)
426	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
427	if (rcStrict == VINF_SUCCESS)
428	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
429	if (rcStrict == VINF_SUCCESS)
430	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
431	if (rcStrict == VINF_SUCCESS)
432	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
433	if (rcStrict == VINF_SUCCESS)
434	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
435	if (rcStrict == VINF_SUCCESS)
436	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
437	if (rcStrict == VINF_SUCCESS)
438	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
439	if (rcStrict == VINF_SUCCESS)
440	{
441	pCtx->rsp = TmpRsp.u;
442	iemRegAddToRip(pIemCpu, cbInstr);
443	}
444	}
445	else
446	{
447	GCPtrBottom--;
448	uint16_t *pa16Mem = NULL;
449	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
450	if (rcStrict == VINF_SUCCESS)
451	{
452	pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
453	pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
454	pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
455	pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
456	pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
457	pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
458	pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
459	pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
460	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
461	if (rcStrict == VINF_SUCCESS)
462	{
463	iemRegSubFromRsp(pIemCpu, pCtx, 16);
464	iemRegAddToRip(pIemCpu, cbInstr);
465	}
466	}
467	}
468	return rcStrict;
469	}
470
471
472	/**
473	* Implements a 32-bit pusha.
474	*/
475	IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
476	{
477	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
478	RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
479	RTGCPTR GCPtrBottom = GCPtrTop - 31;
480	VBOXSTRICTRC rcStrict;
481
482	/*
483	* The docs are a bit hard to comprehend here, but it looks like we wrap
484	* around in real mode as long as none of the individual "pusha" crosses the
485	* end of the stack segment. In protected mode we check the whole access
486	* in one go. For efficiency, only do the word-by-word thing if we're in
487	* danger of wrapping around.
488	*/
489	/** @todo do pusha boundary / wrap-around checks. */
490	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
491	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
492	{
493	/* word-by-word */
494	RTUINT64U TmpRsp;
495	TmpRsp.u = pCtx->rsp;
496	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
497	if (rcStrict == VINF_SUCCESS)
498	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
499	if (rcStrict == VINF_SUCCESS)
500	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
501	if (rcStrict == VINF_SUCCESS)
502	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
503	if (rcStrict == VINF_SUCCESS)
504	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
505	if (rcStrict == VINF_SUCCESS)
506	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
507	if (rcStrict == VINF_SUCCESS)
508	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
509	if (rcStrict == VINF_SUCCESS)
510	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
511	if (rcStrict == VINF_SUCCESS)
512	{
513	pCtx->rsp = TmpRsp.u;
514	iemRegAddToRip(pIemCpu, cbInstr);
515	}
516	}
517	else
518	{
519	GCPtrBottom--;
520	uint32_t *pa32Mem;
521	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
522	if (rcStrict == VINF_SUCCESS)
523	{
524	pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
525	pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
526	pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
527	pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
528	pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
529	pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
530	pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
531	pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
532	rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
533	if (rcStrict == VINF_SUCCESS)
534	{
535	iemRegSubFromRsp(pIemCpu, pCtx, 32);
536	iemRegAddToRip(pIemCpu, cbInstr);
537	}
538	}
539	}
540	return rcStrict;
541	}
542
543
544	/**
545	* Implements pushf.
546	*
547	*
548	* @param enmEffOpSize The effective operand size.
549	*/
550	IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
551	{
552	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
553
554	/*
555	* If we're in V8086 mode some care is required (which is why we're in
556	* doing this in a C implementation).
557	*/
558	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
559	if ( (fEfl & X86_EFL_VM)
560	&& X86_EFL_GET_IOPL(fEfl) != 3 )
561	{
562	Assert(pCtx->cr0 & X86_CR0_PE);
563	if ( enmEffOpSize != IEMMODE_16BIT
564	\|\| !(pCtx->cr4 & X86_CR4_VME))
565	return iemRaiseGeneralProtectionFault0(pIemCpu);
566	fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
567	fEfl \|= (fEfl & X86_EFL_VIF) >> (19 - 9);
568	return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
569	}
570
571	/*
572	* Ok, clear RF and VM and push the flags.
573	*/
574	fEfl &= ~(X86_EFL_RF \| X86_EFL_VM);
575
576	VBOXSTRICTRC rcStrict;
577	switch (enmEffOpSize)
578	{
579	case IEMMODE_16BIT:
580	rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
581	break;
582	case IEMMODE_32BIT:
583	rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
584	break;
585	case IEMMODE_64BIT:
586	rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
587	break;
588	IEM_NOT_REACHED_DEFAULT_CASE_RET();
589	}
590	if (rcStrict != VINF_SUCCESS)
591	return rcStrict;
592
593	iemRegAddToRip(pIemCpu, cbInstr);
594	return VINF_SUCCESS;
595	}
596
597
598	/**
599	* Implements popf.
600	*
601	* @param enmEffOpSize The effective operand size.
602	*/
603	IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
604	{
605	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
606	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
607	uint32_t const fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
608	VBOXSTRICTRC rcStrict;
609	uint32_t fEflNew;
610
611	/*
612	* V8086 is special as usual.
613	*/
614	if (fEflOld & X86_EFL_VM)
615	{
616	/*
617	* Almost anything goes if IOPL is 3.
618	*/
619	if (X86_EFL_GET_IOPL(fEflOld) == 3)
620	{
621	switch (enmEffOpSize)
622	{
623	case IEMMODE_16BIT:
624	{
625	uint16_t u16Value;
626	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
627	if (rcStrict != VINF_SUCCESS)
628	return rcStrict;
629	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
630	break;
631	}
632	case IEMMODE_32BIT:
633	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
634	if (rcStrict != VINF_SUCCESS)
635	return rcStrict;
636	break;
637	IEM_NOT_REACHED_DEFAULT_CASE_RET();
638	}
639
640	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
641	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
642	}
643	/*
644	* Interrupt flag virtualization with CR4.VME=1.
645	*/
646	else if ( enmEffOpSize == IEMMODE_16BIT
647	&& (pCtx->cr4 & X86_CR4_VME) )
648	{
649	uint16_t u16Value;
650	RTUINT64U TmpRsp;
651	TmpRsp.u = pCtx->rsp;
652	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
653	if (rcStrict != VINF_SUCCESS)
654	return rcStrict;
655
656	/** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
657	* or before? */
658	if ( ( (u16Value & X86_EFL_IF)
659	&& (fEflOld & X86_EFL_VIP))
660	\|\| (u16Value & X86_EFL_TF) )
661	return iemRaiseGeneralProtectionFault0(pIemCpu);
662
663	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
664	fEflNew \|= (fEflNew & X86_EFL_IF) << (19 - 9);
665	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
666	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
667
668	pCtx->rsp = TmpRsp.u;
669	}
670	else
671	return iemRaiseGeneralProtectionFault0(pIemCpu);
672
673	}
674	/*
675	* Not in V8086 mode.
676	*/
677	else
678	{
679	/* Pop the flags. */
680	switch (enmEffOpSize)
681	{
682	case IEMMODE_16BIT:
683	{
684	uint16_t u16Value;
685	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
686	if (rcStrict != VINF_SUCCESS)
687	return rcStrict;
688	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
689	break;
690	}
691	case IEMMODE_32BIT:
692	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
693	if (rcStrict != VINF_SUCCESS)
694	return rcStrict;
695	break;
696	case IEMMODE_64BIT:
697	{
698	uint64_t u64Value;
699	rcStrict = iemMemStackPopU64(pIemCpu, &u64Value);
700	if (rcStrict != VINF_SUCCESS)
701	return rcStrict;
702	fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
703	break;
704	}
705	IEM_NOT_REACHED_DEFAULT_CASE_RET();
706	}
707
708	/* Merge them with the current flags. */
709	if ( (fEflNew & (X86_EFL_IOPL \| X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL \| X86_EFL_IF))
710	\|\| pIemCpu->uCpl == 0)
711	{
712	fEflNew &= X86_EFL_POPF_BITS;
713	fEflNew \|= ~X86_EFL_POPF_BITS & fEflOld;
714	}
715	else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
716	{
717	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
718	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
719	}
720	else
721	{
722	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
723	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
724	}
725	}
726
727	/*
728	* Commit the flags.
729	*/
730	Assert(fEflNew & RT_BIT_32(1));
731	IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
732	iemRegAddToRip(pIemCpu, cbInstr);
733
734	return VINF_SUCCESS;
735	}
736
737
738	/**
739	* Implements an indirect call.
740	*
741	* @param uNewPC The new program counter (RIP) value (loaded from the
742	* operand).
743	* @param enmEffOpSize The effective operand size.
744	*/
745	IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
746	{
747	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
748	uint16_t uOldPC = pCtx->ip + cbInstr;
749	if (uNewPC > pCtx->cs.u32Limit)
750	return iemRaiseGeneralProtectionFault0(pIemCpu);
751
752	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
753	if (rcStrict != VINF_SUCCESS)
754	return rcStrict;
755
756	pCtx->rip = uNewPC;
757	return VINF_SUCCESS;
758
759	}
760
761
762	/**
763	* Implements a 16-bit relative call.
764	*
765	* @param offDisp The displacment offset.
766	*/
767	IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
768	{
769	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
770	uint16_t uOldPC = pCtx->ip + cbInstr;
771	uint16_t uNewPC = uOldPC + offDisp;
772	if (uNewPC > pCtx->cs.u32Limit)
773	return iemRaiseGeneralProtectionFault0(pIemCpu);
774
775	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
776	if (rcStrict != VINF_SUCCESS)
777	return rcStrict;
778
779	pCtx->rip = uNewPC;
780	return VINF_SUCCESS;
781	}
782
783
784	/**
785	* Implements a 32-bit indirect call.
786	*
787	* @param uNewPC The new program counter (RIP) value (loaded from the
788	* operand).
789	* @param enmEffOpSize The effective operand size.
790	*/
791	IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
792	{
793	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
794	uint32_t uOldPC = pCtx->eip + cbInstr;
795	if (uNewPC > pCtx->cs.u32Limit)
796	return iemRaiseGeneralProtectionFault0(pIemCpu);
797
798	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
799	if (rcStrict != VINF_SUCCESS)
800	return rcStrict;
801
802	pCtx->rip = uNewPC;
803	return VINF_SUCCESS;
804
805	}
806
807
808	/**
809	* Implements a 32-bit relative call.
810	*
811	* @param offDisp The displacment offset.
812	*/
813	IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
814	{
815	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
816	uint32_t uOldPC = pCtx->eip + cbInstr;
817	uint32_t uNewPC = uOldPC + offDisp;
818	if (uNewPC > pCtx->cs.u32Limit)
819	return iemRaiseGeneralProtectionFault0(pIemCpu);
820
821	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
822	if (rcStrict != VINF_SUCCESS)
823	return rcStrict;
824
825	pCtx->rip = uNewPC;
826	return VINF_SUCCESS;
827	}
828
829
830	/**
831	* Implements a 64-bit indirect call.
832	*
833	* @param uNewPC The new program counter (RIP) value (loaded from the
834	* operand).
835	* @param enmEffOpSize The effective operand size.
836	*/
837	IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
838	{
839	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
840	uint64_t uOldPC = pCtx->rip + cbInstr;
841	if (!IEM_IS_CANONICAL(uNewPC))
842	return iemRaiseGeneralProtectionFault0(pIemCpu);
843
844	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
845	if (rcStrict != VINF_SUCCESS)
846	return rcStrict;
847
848	pCtx->rip = uNewPC;
849	return VINF_SUCCESS;
850
851	}
852
853
854	/**
855	* Implements a 64-bit relative call.
856	*
857	* @param offDisp The displacment offset.
858	*/
859	IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
860	{
861	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
862	uint64_t uOldPC = pCtx->rip + cbInstr;
863	uint64_t uNewPC = uOldPC + offDisp;
864	if (!IEM_IS_CANONICAL(uNewPC))
865	return iemRaiseNotCanonical(pIemCpu);
866
867	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
868	if (rcStrict != VINF_SUCCESS)
869	return rcStrict;
870
871	pCtx->rip = uNewPC;
872	return VINF_SUCCESS;
873	}
874
875
876	/**
877	* Implements far jumps and calls thru task segments (TSS).
878	*
879	* @param uSel The selector.
880	* @param enmBranch The kind of branching we're performing.
881	* @param enmEffOpSize The effective operand size.
882	* @param pDesc The descriptor corrsponding to @a uSel. The type is
883	* call gate.
884	*/
885	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
886	{
887	/* Call various functions to do the work. */
888	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
889	}
890
891
892	/**
893	* Implements far jumps and calls thru task gates.
894	*
895	* @param uSel The selector.
896	* @param enmBranch The kind of branching we're performing.
897	* @param enmEffOpSize The effective operand size.
898	* @param pDesc The descriptor corrsponding to @a uSel. The type is
899	* call gate.
900	*/
901	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
902	{
903	/* Call various functions to do the work. */
904	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
905	}
906
907
908	/**
909	* Implements far jumps and calls thru call gates.
910	*
911	* @param uSel The selector.
912	* @param enmBranch The kind of branching we're performing.
913	* @param enmEffOpSize The effective operand size.
914	* @param pDesc The descriptor corrsponding to @a uSel. The type is
915	* call gate.
916	*/
917	IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
918	{
919	/* Call various functions to do the work. */
920	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
921	}
922
923
924	/**
925	* Implements far jumps and calls thru system selectors.
926	*
927	* @param uSel The selector.
928	* @param enmBranch The kind of branching we're performing.
929	* @param enmEffOpSize The effective operand size.
930	* @param pDesc The descriptor corrsponding to @a uSel.
931	*/
932	IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
933	{
934	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
935	Assert((uSel & X86_SEL_MASK_OFF_RPL));
936
937	if (IEM_IS_LONG_MODE(pIemCpu))
938	switch (pDesc->Legacy.Gen.u4Type)
939	{
940	case AMD64_SEL_TYPE_SYS_CALL_GATE:
941	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
942
943	default:
944	case AMD64_SEL_TYPE_SYS_LDT:
945	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
946	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
947	case AMD64_SEL_TYPE_SYS_TRAP_GATE:
948	case AMD64_SEL_TYPE_SYS_INT_GATE:
949	Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
950	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
951
952	}
953
954	switch (pDesc->Legacy.Gen.u4Type)
955	{
956	case X86_SEL_TYPE_SYS_286_CALL_GATE:
957	case X86_SEL_TYPE_SYS_386_CALL_GATE:
958	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
959
960	case X86_SEL_TYPE_SYS_TASK_GATE:
961	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
962
963	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
964	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
965	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
966
967	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
968	Log(("branch %04x -> busy 286 TSS\n", uSel));
969	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
970
971	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
972	Log(("branch %04x -> busy 386 TSS\n", uSel));
973	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
974
975	default:
976	case X86_SEL_TYPE_SYS_LDT:
977	case X86_SEL_TYPE_SYS_286_INT_GATE:
978	case X86_SEL_TYPE_SYS_286_TRAP_GATE:
979	case X86_SEL_TYPE_SYS_386_INT_GATE:
980	case X86_SEL_TYPE_SYS_386_TRAP_GATE:
981	Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
982	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
983	}
984	}
985
986
987	/**
988	* Implements far jumps.
989	*
990	* @param uSel The selector.
991	* @param offSeg The segment offset.
992	* @param enmEffOpSize The effective operand size.
993	*/
994	IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
995	{
996	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
997	NOREF(cbInstr);
998	Assert(offSeg <= UINT32_MAX);
999
1000	/*
1001	* Real mode and V8086 mode are easy. The only snag seems to be that
1002	* CS.limit doesn't change and the limit check is done against the current
1003	* limit.
1004	*/
1005	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1006	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1007	{
1008	if (offSeg > pCtx->cs.u32Limit)
1009	return iemRaiseGeneralProtectionFault0(pIemCpu);
1010
1011	if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1012	pCtx->rip = offSeg;
1013	else
1014	pCtx->rip = offSeg & UINT16_MAX;
1015	pCtx->cs.Sel = uSel;
1016	pCtx->cs.ValidSel = uSel;
1017	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1018	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1019	return VINF_SUCCESS;
1020	}
1021
1022	/*
1023	* Protected mode. Need to parse the specified descriptor...
1024	*/
1025	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1026	{
1027	Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1028	return iemRaiseGeneralProtectionFault0(pIemCpu);
1029	}
1030
1031	/* Fetch the descriptor. */
1032	IEMSELDESC Desc;
1033	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1034	if (rcStrict != VINF_SUCCESS)
1035	return rcStrict;
1036
1037	/* Is it there? */
1038	if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1039	{
1040	Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1041	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1042	}
1043
1044	/*
1045	* Deal with it according to its type. We do the standard code selectors
1046	* here and dispatch the system selectors to worker functions.
1047	*/
1048	if (!Desc.Legacy.Gen.u1DescType)
1049	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1050
1051	/* Only code segments. */
1052	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1053	{
1054	Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1055	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1056	}
1057
1058	/* L vs D. */
1059	if ( Desc.Legacy.Gen.u1Long
1060	&& Desc.Legacy.Gen.u1DefBig
1061	&& IEM_IS_LONG_MODE(pIemCpu))
1062	{
1063	Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1064	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1065	}
1066
1067	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1068	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1069	{
1070	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1071	{
1072	Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1073	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1074	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1075	}
1076	}
1077	else
1078	{
1079	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1080	{
1081	Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1082	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1083	}
1084	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1085	{
1086	Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1087	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1088	}
1089	}
1090
1091	/* Chop the high bits if 16-bit (Intel says so). */
1092	if (enmEffOpSize == IEMMODE_16BIT)
1093	offSeg &= UINT16_MAX;
1094
1095	/* Limit check. (Should alternatively check for non-canonical addresses
1096	here, but that is ruled out by offSeg being 32-bit, right?) */
1097	uint64_t u64Base;
1098	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1099	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1100	u64Base = 0;
1101	else
1102	{
1103	if (offSeg > cbLimit)
1104	{
1105	Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1106	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1107	}
1108	u64Base = X86DESC_BASE(&Desc.Legacy);
1109	}
1110
1111	/*
1112	* Ok, everything checked out fine. Now set the accessed bit before
1113	* committing the result into CS, CSHID and RIP.
1114	*/
1115	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1116	{
1117	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1118	if (rcStrict != VINF_SUCCESS)
1119	return rcStrict;
1120	/** @todo check what VT-x and AMD-V does. */
1121	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1122	}
1123
1124	/* commit */
1125	pCtx->rip = offSeg;
1126	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1127	pCtx->cs.Sel \|= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1128	pCtx->cs.ValidSel = pCtx->cs.Sel;
1129	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1130	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1131	pCtx->cs.u32Limit = cbLimit;
1132	pCtx->cs.u64Base = u64Base;
1133	/** @todo check if the hidden bits are loaded correctly for 64-bit
1134	* mode. */
1135	return VINF_SUCCESS;
1136	}
1137
1138
1139	/**
1140	* Implements far calls.
1141	*
1142	* This very similar to iemCImpl_FarJmp.
1143	*
1144	* @param uSel The selector.
1145	* @param offSeg The segment offset.
1146	* @param enmEffOpSize The operand size (in case we need it).
1147	*/
1148	IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1149	{
1150	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1151	VBOXSTRICTRC rcStrict;
1152	uint64_t uNewRsp;
1153	RTPTRUNION uPtrRet;
1154
1155	/*
1156	* Real mode and V8086 mode are easy. The only snag seems to be that
1157	* CS.limit doesn't change and the limit check is done against the current
1158	* limit.
1159	*/
1160	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1161	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1162	{
1163	Assert(enmEffOpSize == IEMMODE_16BIT \|\| enmEffOpSize == IEMMODE_32BIT);
1164
1165	/* Check stack first - may #SS(0). */
1166	rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1167	&uPtrRet.pv, &uNewRsp);
1168	if (rcStrict != VINF_SUCCESS)
1169	return rcStrict;
1170
1171	/* Check the target address range. */
1172	if (offSeg > UINT32_MAX)
1173	return iemRaiseGeneralProtectionFault0(pIemCpu);
1174
1175	/* Everything is fine, push the return address. */
1176	if (enmEffOpSize == IEMMODE_16BIT)
1177	{
1178	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1179	uPtrRet.pu16[1] = pCtx->cs.Sel;
1180	}
1181	else
1182	{
1183	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1184	uPtrRet.pu16[3] = pCtx->cs.Sel;
1185	}
1186	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1187	if (rcStrict != VINF_SUCCESS)
1188	return rcStrict;
1189
1190	/* Branch. */
1191	pCtx->rip = offSeg;
1192	pCtx->cs.Sel = uSel;
1193	pCtx->cs.ValidSel = uSel;
1194	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1195	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1196	return VINF_SUCCESS;
1197	}
1198
1199	/*
1200	* Protected mode. Need to parse the specified descriptor...
1201	*/
1202	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1203	{
1204	Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1205	return iemRaiseGeneralProtectionFault0(pIemCpu);
1206	}
1207
1208	/* Fetch the descriptor. */
1209	IEMSELDESC Desc;
1210	rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1211	if (rcStrict != VINF_SUCCESS)
1212	return rcStrict;
1213
1214	/*
1215	* Deal with it according to its type. We do the standard code selectors
1216	* here and dispatch the system selectors to worker functions.
1217	*/
1218	if (!Desc.Legacy.Gen.u1DescType)
1219	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1220
1221	/* Only code segments. */
1222	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1223	{
1224	Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1225	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1226	}
1227
1228	/* L vs D. */
1229	if ( Desc.Legacy.Gen.u1Long
1230	&& Desc.Legacy.Gen.u1DefBig
1231	&& IEM_IS_LONG_MODE(pIemCpu))
1232	{
1233	Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1234	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1235	}
1236
1237	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1238	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1239	{
1240	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1241	{
1242	Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1243	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1244	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1245	}
1246	}
1247	else
1248	{
1249	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1250	{
1251	Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1252	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1253	}
1254	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1255	{
1256	Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1257	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1258	}
1259	}
1260
1261	/* Is it there? */
1262	if (!Desc.Legacy.Gen.u1Present)
1263	{
1264	Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1265	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1266	}
1267
1268	/* Check stack first - may #SS(0). */
1269	/** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
1270	* 16-bit code cause a two or four byte CS to be pushed? */
1271	rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1272	enmEffOpSize == IEMMODE_64BIT ? 8+8
1273	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1274	&uPtrRet.pv, &uNewRsp);
1275	if (rcStrict != VINF_SUCCESS)
1276	return rcStrict;
1277
1278	/* Chop the high bits if 16-bit (Intel says so). */
1279	if (enmEffOpSize == IEMMODE_16BIT)
1280	offSeg &= UINT16_MAX;
1281
1282	/* Limit / canonical check. */
1283	uint64_t u64Base;
1284	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1285	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1286	{
1287	if (!IEM_IS_CANONICAL(offSeg))
1288	{
1289	Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
1290	return iemRaiseNotCanonical(pIemCpu);
1291	}
1292	u64Base = 0;
1293	}
1294	else
1295	{
1296	if (offSeg > cbLimit)
1297	{
1298	Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1299	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1300	}
1301	u64Base = X86DESC_BASE(&Desc.Legacy);
1302	}
1303
1304	/*
1305	* Now set the accessed bit before
1306	* writing the return address to the stack and committing the result into
1307	* CS, CSHID and RIP.
1308	*/
1309	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1310	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1311	{
1312	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1313	if (rcStrict != VINF_SUCCESS)
1314	return rcStrict;
1315	/** @todo check what VT-x and AMD-V does. */
1316	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1317	}
1318
1319	/* stack */
1320	if (enmEffOpSize == IEMMODE_16BIT)
1321	{
1322	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1323	uPtrRet.pu16[1] = pCtx->cs.Sel;
1324	}
1325	else if (enmEffOpSize == IEMMODE_32BIT)
1326	{
1327	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1328	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
1329	}
1330	else
1331	{
1332	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1333	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
1334	}
1335	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1336	if (rcStrict != VINF_SUCCESS)
1337	return rcStrict;
1338
1339	/* commit */
1340	pCtx->rip = offSeg;
1341	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1342	pCtx->cs.Sel \|= pIemCpu->uCpl;
1343	pCtx->cs.ValidSel = pCtx->cs.Sel;
1344	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1345	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1346	pCtx->cs.u32Limit = cbLimit;
1347	pCtx->cs.u64Base = u64Base;
1348	/** @todo check if the hidden bits are loaded correctly for 64-bit
1349	* mode. */
1350	return VINF_SUCCESS;
1351	}
1352
1353
1354	/**
1355	* Implements retf.
1356	*
1357	* @param enmEffOpSize The effective operand size.
1358	* @param cbPop The amount of arguments to pop from the stack
1359	* (bytes).
1360	*/
1361	IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1362	{
1363	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1364	VBOXSTRICTRC rcStrict;
1365	RTCPTRUNION uPtrFrame;
1366	uint64_t uNewRsp;
1367	uint64_t uNewRip;
1368	uint16_t uNewCs;
1369	NOREF(cbInstr);
1370
1371	/*
1372	* Read the stack values first.
1373	*/
1374	uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
1375	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
1376	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
1377	if (rcStrict != VINF_SUCCESS)
1378	return rcStrict;
1379	if (enmEffOpSize == IEMMODE_16BIT)
1380	{
1381	uNewRip = uPtrFrame.pu16[0];
1382	uNewCs = uPtrFrame.pu16[1];
1383	}
1384	else if (enmEffOpSize == IEMMODE_32BIT)
1385	{
1386	uNewRip = uPtrFrame.pu32[0];
1387	uNewCs = uPtrFrame.pu16[2];
1388	}
1389	else
1390	{
1391	uNewRip = uPtrFrame.pu64[0];
1392	uNewCs = uPtrFrame.pu16[4];
1393	}
1394
1395	/*
1396	* Real mode and V8086 mode are easy.
1397	*/
1398	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1399	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1400	{
1401	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
1402	/** @todo check how this is supposed to work if sp=0xfffe. */
1403
1404	/* Check the limit of the new EIP. */
1405	/** @todo Intel pseudo code only does the limit check for 16-bit
1406	* operands, AMD does not make any distinction. What is right? */
1407	if (uNewRip > pCtx->cs.u32Limit)
1408	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1409
1410	/* commit the operation. */
1411	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1412	if (rcStrict != VINF_SUCCESS)
1413	return rcStrict;
1414	pCtx->rip = uNewRip;
1415	pCtx->cs.Sel = uNewCs;
1416	pCtx->cs.ValidSel = uNewCs;
1417	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1418	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
1419	/** @todo do we load attribs and limit as well? */
1420	if (cbPop)
1421	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1422	return VINF_SUCCESS;
1423	}
1424
1425	/*
1426	* Protected mode is complicated, of course.
1427	*/
1428	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
1429	{
1430	Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
1431	return iemRaiseGeneralProtectionFault0(pIemCpu);
1432	}
1433
1434	/* Fetch the descriptor. */
1435	IEMSELDESC DescCs;
1436	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs, X86_XCPT_GP);
1437	if (rcStrict != VINF_SUCCESS)
1438	return rcStrict;
1439
1440	/* Can only return to a code selector. */
1441	if ( !DescCs.Legacy.Gen.u1DescType
1442	\|\| !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1443	{
1444	Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1445	uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
1446	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1447	}
1448
1449	/* L vs D. */
1450	if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
1451	&& DescCs.Legacy.Gen.u1DefBig
1452	&& IEM_IS_LONG_MODE(pIemCpu))
1453	{
1454	Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
1455	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1456	}
1457
1458	/* DPL/RPL/CPL checks. */
1459	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
1460	{
1461	Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
1462	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1463	}
1464
1465	if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1466	{
1467	if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
1468	{
1469	Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
1470	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1471	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1472	}
1473	}
1474	else
1475	{
1476	if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
1477	{
1478	Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
1479	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1480	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1481	}
1482	}
1483
1484	/* Is it there? */
1485	if (!DescCs.Legacy.Gen.u1Present)
1486	{
1487	Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
1488	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1489	}
1490
1491	/*
1492	* Return to outer privilege? (We'll typically have entered via a call gate.)
1493	*/
1494	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
1495	{
1496	/* Read the return pointer, it comes before the parameters. */
1497	RTCPTRUNION uPtrStack;
1498	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
1499	if (rcStrict != VINF_SUCCESS)
1500	return rcStrict;
1501	uint16_t uNewOuterSs;
1502	uint64_t uNewOuterRsp;
1503	if (enmEffOpSize == IEMMODE_16BIT)
1504	{
1505	uNewOuterRsp = uPtrFrame.pu16[0];
1506	uNewOuterSs = uPtrFrame.pu16[1];
1507	}
1508	else if (enmEffOpSize == IEMMODE_32BIT)
1509	{
1510	uNewOuterRsp = uPtrFrame.pu32[0];
1511	uNewOuterSs = uPtrFrame.pu16[2];
1512	}
1513	else
1514	{
1515	uNewOuterRsp = uPtrFrame.pu64[0];
1516	uNewOuterSs = uPtrFrame.pu16[4];
1517	}
1518
1519	/* Check for NULL stack selector (invalid in ring-3 and non-long mode)
1520	and read the selector. */
1521	IEMSELDESC DescSs;
1522	if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
1523	{
1524	if ( !DescCs.Legacy.Gen.u1Long
1525	\|\| (uNewOuterSs & X86_SEL_RPL) == 3)
1526	{
1527	Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
1528	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1529	return iemRaiseGeneralProtectionFault0(pIemCpu);
1530	}
1531	/** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
1532	iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
1533	}
1534	else
1535	{
1536	/* Fetch the descriptor for the new stack segment. */
1537	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
1538	if (rcStrict != VINF_SUCCESS)
1539	return rcStrict;
1540	}
1541
1542	/* Check that RPL of stack and code selectors match. */
1543	if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
1544	{
1545	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1546	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1547	}
1548
1549	/* Must be a writable data segment. */
1550	if ( !DescSs.Legacy.Gen.u1DescType
1551	\|\| (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1552	\|\| !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1553	{
1554	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
1555	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1556	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1557	}
1558
1559	/* L vs D. (Not mentioned by intel.) */
1560	if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
1561	&& DescSs.Legacy.Gen.u1DefBig
1562	&& IEM_IS_LONG_MODE(pIemCpu))
1563	{
1564	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
1565	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1566	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1567	}
1568
1569	/* DPL/RPL/CPL checks. */
1570	if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
1571	{
1572	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
1573	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
1574	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1575	}
1576
1577	/* Is it there? */
1578	if (!DescSs.Legacy.Gen.u1Present)
1579	{
1580	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1581	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1582	}
1583
1584	/* Calc SS limit.*/
1585	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
1586
1587	/* Is RIP canonical or within CS.limit? */
1588	uint64_t u64Base;
1589	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1590
1591	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1592	{
1593	if (!IEM_IS_CANONICAL(uNewRip))
1594	{
1595	Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1596	return iemRaiseNotCanonical(pIemCpu);
1597	}
1598	u64Base = 0;
1599	}
1600	else
1601	{
1602	if (uNewRip > cbLimitCs)
1603	{
1604	Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
1605	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
1606	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1607	}
1608	u64Base = X86DESC_BASE(&DescCs.Legacy);
1609	}
1610
1611	/*
1612	* Now set the accessed bit before
1613	* writing the return address to the stack and committing the result into
1614	* CS, CSHID and RIP.
1615	*/
1616	/** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
1617	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1618	{
1619	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1620	if (rcStrict != VINF_SUCCESS)
1621	return rcStrict;
1622	/** @todo check what VT-x and AMD-V does. */
1623	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1624	}
1625	/** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
1626	if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1627	{
1628	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
1629	if (rcStrict != VINF_SUCCESS)
1630	return rcStrict;
1631	/** @todo check what VT-x and AMD-V does. */
1632	DescSs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1633	}
1634
1635	/* commit */
1636	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1637	if (rcStrict != VINF_SUCCESS)
1638	return rcStrict;
1639	if (enmEffOpSize == IEMMODE_16BIT)
1640	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1641	else
1642	pCtx->rip = uNewRip;
1643	pCtx->cs.Sel = uNewCs;
1644	pCtx->cs.ValidSel = uNewCs;
1645	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1646	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1647	pCtx->cs.u32Limit = cbLimitCs;
1648	pCtx->cs.u64Base = u64Base;
1649	pCtx->rsp = uNewRsp;
1650	pCtx->ss.Sel = uNewOuterSs;
1651	pCtx->ss.ValidSel = uNewOuterSs;
1652	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1653	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
1654	pCtx->ss.u32Limit = cbLimitSs;
1655	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1656	pCtx->ss.u64Base = 0;
1657	else
1658	pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
1659
1660	pIemCpu->uCpl = (uNewCs & X86_SEL_RPL);
1661	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
1662	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
1663	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
1664	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
1665
1666	/** @todo check if the hidden bits are loaded correctly for 64-bit
1667	* mode. */
1668
1669	if (cbPop)
1670	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1671
1672	/* Done! */
1673	}
1674	/*
1675	* Return to the same privilege level
1676	*/
1677	else
1678	{
1679	/* Limit / canonical check. */
1680	uint64_t u64Base;
1681	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1682
1683	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1684	{
1685	if (!IEM_IS_CANONICAL(uNewRip))
1686	{
1687	Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
1688	return iemRaiseNotCanonical(pIemCpu);
1689	}
1690	u64Base = 0;
1691	}
1692	else
1693	{
1694	if (uNewRip > cbLimitCs)
1695	{
1696	Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
1697	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1698	}
1699	u64Base = X86DESC_BASE(&DescCs.Legacy);
1700	}
1701
1702	/*
1703	* Now set the accessed bit before
1704	* writing the return address to the stack and committing the result into
1705	* CS, CSHID and RIP.
1706	*/
1707	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1708	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1709	{
1710	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1711	if (rcStrict != VINF_SUCCESS)
1712	return rcStrict;
1713	/** @todo check what VT-x and AMD-V does. */
1714	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1715	}
1716
1717	/* commit */
1718	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1719	if (rcStrict != VINF_SUCCESS)
1720	return rcStrict;
1721	if (enmEffOpSize == IEMMODE_16BIT)
1722	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1723	else
1724	pCtx->rip = uNewRip;
1725	pCtx->cs.Sel = uNewCs;
1726	pCtx->cs.ValidSel = uNewCs;
1727	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1728	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1729	pCtx->cs.u32Limit = cbLimitCs;
1730	pCtx->cs.u64Base = u64Base;
1731	/** @todo check if the hidden bits are loaded correctly for 64-bit
1732	* mode. */
1733	if (cbPop)
1734	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1735	}
1736	return VINF_SUCCESS;
1737	}
1738
1739
1740	/**
1741	* Implements retn.
1742	*
1743	* We're doing this in C because of the \#GP that might be raised if the popped
1744	* program counter is out of bounds.
1745	*
1746	* @param enmEffOpSize The effective operand size.
1747	* @param cbPop The amount of arguments to pop from the stack
1748	* (bytes).
1749	*/
1750	IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1751	{
1752	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1753	NOREF(cbInstr);
1754
1755	/* Fetch the RSP from the stack. */
1756	VBOXSTRICTRC rcStrict;
1757	RTUINT64U NewRip;
1758	RTUINT64U NewRsp;
1759	NewRsp.u = pCtx->rsp;
1760	switch (enmEffOpSize)
1761	{
1762	case IEMMODE_16BIT:
1763	NewRip.u = 0;
1764	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
1765	break;
1766	case IEMMODE_32BIT:
1767	NewRip.u = 0;
1768	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
1769	break;
1770	case IEMMODE_64BIT:
1771	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
1772	break;
1773	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1774	}
1775	if (rcStrict != VINF_SUCCESS)
1776	return rcStrict;
1777
1778	/* Check the new RSP before loading it. */
1779	/** @todo Should test this as the intel+amd pseudo code doesn't mention half
1780	* of it. The canonical test is performed here and for call. */
1781	if (enmEffOpSize != IEMMODE_64BIT)
1782	{
1783	if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
1784	{
1785	Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
1786	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1787	}
1788	}
1789	else
1790	{
1791	if (!IEM_IS_CANONICAL(NewRip.u))
1792	{
1793	Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
1794	return iemRaiseNotCanonical(pIemCpu);
1795	}
1796	}
1797
1798	/* Commit it. */
1799	pCtx->rip = NewRip.u;
1800	pCtx->rsp = NewRsp.u;
1801	if (cbPop)
1802	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1803
1804	return VINF_SUCCESS;
1805	}
1806
1807
1808	/**
1809	* Implements enter.
1810	*
1811	* We're doing this in C because the instruction is insane, even for the
1812	* u8NestingLevel=0 case dealing with the stack is tedious.
1813	*
1814	* @param enmEffOpSize The effective operand size.
1815	*/
1816	IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
1817	{
1818	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1819
1820	/* Push RBP, saving the old value in TmpRbp. */
1821	RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
1822	RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
1823	RTUINT64U NewRbp;
1824	VBOXSTRICTRC rcStrict;
1825	if (enmEffOpSize == IEMMODE_64BIT)
1826	{
1827	rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
1828	NewRbp = NewRsp;
1829	}
1830	else if (pCtx->ss.Attr.n.u1DefBig)
1831	{
1832	rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
1833	NewRbp = NewRsp;
1834	}
1835	else
1836	{
1837	rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
1838	NewRbp = TmpRbp;
1839	NewRbp.Words.w0 = NewRsp.Words.w0;
1840	}
1841	if (rcStrict != VINF_SUCCESS)
1842	return rcStrict;
1843
1844	/* Copy the parameters (aka nesting levels by Intel). */
1845	cParameters &= 0x1f;
1846	if (cParameters > 0)
1847	{
1848	switch (enmEffOpSize)
1849	{
1850	case IEMMODE_16BIT:
1851	if (pCtx->ss.Attr.n.u1DefBig)
1852	TmpRbp.DWords.dw0 -= 2;
1853	else
1854	TmpRbp.Words.w0 -= 2;
1855	do
1856	{
1857	uint16_t u16Tmp;
1858	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
1859	if (rcStrict != VINF_SUCCESS)
1860	break;
1861	rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
1862	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1863	break;
1864
1865	case IEMMODE_32BIT:
1866	if (pCtx->ss.Attr.n.u1DefBig)
1867	TmpRbp.DWords.dw0 -= 4;
1868	else
1869	TmpRbp.Words.w0 -= 4;
1870	do
1871	{
1872	uint32_t u32Tmp;
1873	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
1874	if (rcStrict != VINF_SUCCESS)
1875	break;
1876	rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
1877	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1878	break;
1879
1880	case IEMMODE_64BIT:
1881	TmpRbp.u -= 8;
1882	do
1883	{
1884	uint64_t u64Tmp;
1885	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
1886	if (rcStrict != VINF_SUCCESS)
1887	break;
1888	rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
1889	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1890	break;
1891
1892	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1893	}
1894	if (rcStrict != VINF_SUCCESS)
1895	return VINF_SUCCESS;
1896
1897	/* Push the new RBP */
1898	if (enmEffOpSize == IEMMODE_64BIT)
1899	rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
1900	else if (pCtx->ss.Attr.n.u1DefBig)
1901	rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
1902	else
1903	rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
1904	if (rcStrict != VINF_SUCCESS)
1905	return rcStrict;
1906
1907	}
1908
1909	/* Recalc RSP. */
1910	iemRegSubFromRspEx(pIemCpu, pCtx, &NewRsp, cbFrame);
1911
1912	/** @todo Should probe write access at the new RSP according to AMD. */
1913
1914	/* Commit it. */
1915	pCtx->rbp = NewRbp.u;
1916	pCtx->rsp = NewRsp.u;
1917	iemRegAddToRip(pIemCpu, cbInstr);
1918
1919	return VINF_SUCCESS;
1920	}
1921
1922
1923
1924	/**
1925	* Implements leave.
1926	*
1927	* We're doing this in C because messing with the stack registers is annoying
1928	* since they depends on SS attributes.
1929	*
1930	* @param enmEffOpSize The effective operand size.
1931	*/
1932	IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
1933	{
1934	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1935
1936	/* Calculate the intermediate RSP from RBP and the stack attributes. */
1937	RTUINT64U NewRsp;
1938	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1939	NewRsp.u = pCtx->rbp;
1940	else if (pCtx->ss.Attr.n.u1DefBig)
1941	NewRsp.u = pCtx->ebp;
1942	else
1943	{
1944	/** @todo Check that LEAVE actually preserve the high EBP bits. */
1945	NewRsp.u = pCtx->rsp;
1946	NewRsp.Words.w0 = pCtx->bp;
1947	}
1948
1949	/* Pop RBP according to the operand size. */
1950	VBOXSTRICTRC rcStrict;
1951	RTUINT64U NewRbp;
1952	switch (enmEffOpSize)
1953	{
1954	case IEMMODE_16BIT:
1955	NewRbp.u = pCtx->rbp;
1956	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
1957	break;
1958	case IEMMODE_32BIT:
1959	NewRbp.u = 0;
1960	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
1961	break;
1962	case IEMMODE_64BIT:
1963	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
1964	break;
1965	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1966	}
1967	if (rcStrict != VINF_SUCCESS)
1968	return rcStrict;
1969
1970
1971	/* Commit it. */
1972	pCtx->rbp = NewRbp.u;
1973	pCtx->rsp = NewRsp.u;
1974	iemRegAddToRip(pIemCpu, cbInstr);
1975
1976	return VINF_SUCCESS;
1977	}
1978
1979
1980	/**
1981	* Implements int3 and int XX.
1982	*
1983	* @param u8Int The interrupt vector number.
1984	* @param fIsBpInstr Is it the breakpoint instruction.
1985	*/
1986	IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
1987	{
1988	Assert(pIemCpu->cXcptRecursions == 0);
1989	return iemRaiseXcptOrInt(pIemCpu,
1990	cbInstr,
1991	u8Int,
1992	(fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) \| IEM_XCPT_FLAGS_T_SOFT_INT,
1993	0,
1994	0);
1995	}
1996
1997
1998	/**
1999	* Implements iret for real mode and V8086 mode.
2000	*
2001	* @param enmEffOpSize The effective operand size.
2002	*/
2003	IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2004	{
2005	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2006	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
2007	X86EFLAGS Efl;
2008	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2009	NOREF(cbInstr);
2010
2011	/*
2012	* iret throws an exception if VME isn't enabled.
2013	*/
2014	if ( Efl.Bits.u1VM
2015	&& Efl.Bits.u2IOPL != 3
2016	&& !(pCtx->cr4 & X86_CR4_VME))
2017	return iemRaiseGeneralProtectionFault0(pIemCpu);
2018
2019	/*
2020	* Do the stack bits, but don't commit RSP before everything checks
2021	* out right.
2022	*/
2023	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2024	VBOXSTRICTRC rcStrict;
2025	RTCPTRUNION uFrame;
2026	uint16_t uNewCs;
2027	uint32_t uNewEip;
2028	uint32_t uNewFlags;
2029	uint64_t uNewRsp;
2030	if (enmEffOpSize == IEMMODE_32BIT)
2031	{
2032	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2033	if (rcStrict != VINF_SUCCESS)
2034	return rcStrict;
2035	uNewEip = uFrame.pu32[0];
2036	if (uNewEip > UINT16_MAX)
2037	return iemRaiseGeneralProtectionFault0(pIemCpu);
2038
2039	uNewCs = (uint16_t)uFrame.pu32[1];
2040	uNewFlags = uFrame.pu32[2];
2041	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2042	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT
2043	\| X86_EFL_RF /\| X86_EFL_VM/ \| X86_EFL_AC /\|X86_EFL_VIF/ /\|X86_EFL_VIP/
2044	\| X86_EFL_ID;
2045	uNewFlags \|= Efl.u & (X86_EFL_VM \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_1);
2046	}
2047	else
2048	{
2049	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2050	if (rcStrict != VINF_SUCCESS)
2051	return rcStrict;
2052	uNewEip = uFrame.pu16[0];
2053	uNewCs = uFrame.pu16[1];
2054	uNewFlags = uFrame.pu16[2];
2055	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2056	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT;
2057	uNewFlags \|= Efl.u & (UINT32_C(0xffff0000) \| X86_EFL_1);
2058	/** @todo The intel pseudo code does not indicate what happens to
2059	* reserved flags. We just ignore them. */
2060	}
2061	/** @todo Check how this is supposed to work if sp=0xfffe. */
2062
2063	/*
2064	* Check the limit of the new EIP.
2065	*/
2066	/** @todo Only the AMD pseudo code check the limit here, what's
2067	* right? */
2068	if (uNewEip > pCtx->cs.u32Limit)
2069	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2070
2071	/*
2072	* V8086 checks and flag adjustments
2073	*/
2074	if (Efl.Bits.u1VM)
2075	{
2076	if (Efl.Bits.u2IOPL == 3)
2077	{
2078	/* Preserve IOPL and clear RF. */
2079	uNewFlags &= ~(X86_EFL_IOPL \| X86_EFL_RF);
2080	uNewFlags \|= Efl.u & (X86_EFL_IOPL);
2081	}
2082	else if ( enmEffOpSize == IEMMODE_16BIT
2083	&& ( !(uNewFlags & X86_EFL_IF)
2084	\|\| !Efl.Bits.u1VIP )
2085	&& !(uNewFlags & X86_EFL_TF) )
2086	{
2087	/* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2088	uNewFlags &= ~X86_EFL_VIF;
2089	uNewFlags \|= (uNewFlags & X86_EFL_IF) << (19 - 9);
2090	uNewFlags &= ~(X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_RF);
2091	uNewFlags \|= Efl.u & (X86_EFL_IF \| X86_EFL_IOPL);
2092	}
2093	else
2094	return iemRaiseGeneralProtectionFault0(pIemCpu);
2095	}
2096
2097	/*
2098	* Commit the operation.
2099	*/
2100	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
2101	if (rcStrict != VINF_SUCCESS)
2102	return rcStrict;
2103	#ifdef DBGFTRACE_ENABLED
2104	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2105	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2106	#endif
2107
2108	pCtx->rip = uNewEip;
2109	pCtx->cs.Sel = uNewCs;
2110	pCtx->cs.ValidSel = uNewCs;
2111	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2112	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2113	/** @todo do we load attribs and limit as well? */
2114	Assert(uNewFlags & X86_EFL_1);
2115	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2116
2117	return VINF_SUCCESS;
2118	}
2119
2120
2121	/**
2122	* Loads a segment register when entering V8086 mode.
2123	*
2124	* @param pSReg The segment register.
2125	* @param uSeg The segment to load.
2126	*/
2127	static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2128	{
2129	pSReg->Sel = uSeg;
2130	pSReg->ValidSel = uSeg;
2131	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2132	pSReg->u64Base = (uint32_t)uSeg << 4;
2133	pSReg->u32Limit = 0xffff;
2134	pSReg->Attr.u = X86_SEL_TYPE_RW_ACC \| RT_BIT(4) /!sys/ \| RT_BIT(7) /P/ \| (3 /DPL/ << 5); /* VT-x wants 0xf3 */
2135	/** @todo Testcase: Check if VT-x really needs this and what it does itself when
2136	* IRET'ing to V8086. */
2137	}
2138
2139
2140	/**
2141	* Implements iret for protected mode returning to V8086 mode.
2142	*
2143	* @param pCtx Pointer to the CPU context.
2144	* @param uNewEip The new EIP.
2145	* @param uNewCs The new CS.
2146	* @param uNewFlags The new EFLAGS.
2147	* @param uNewRsp The RSP after the initial IRET frame.
2148	*
2149	* @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2150	*/
2151	IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2152	uint32_t, uNewFlags, uint64_t, uNewRsp)
2153	{
2154	#if 0
2155	if (!LogIs6Enabled())
2156	{
2157	RTLogGroupSettings(NULL, "iem.eo.l6.l2");
2158	RTLogFlags(NULL, "enabled");
2159	return VERR_IEM_RESTART_INSTRUCTION;
2160	}
2161	#endif
2162
2163	/*
2164	* Pop the V8086 specific frame bits off the stack.
2165	*/
2166	VBOXSTRICTRC rcStrict;
2167	RTCPTRUNION uFrame;
2168	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
2169	if (rcStrict != VINF_SUCCESS)
2170	return rcStrict;
2171	uint32_t uNewEsp = uFrame.pu32[0];
2172	uint16_t uNewSs = uFrame.pu32[1];
2173	uint16_t uNewEs = uFrame.pu32[2];
2174	uint16_t uNewDs = uFrame.pu32[3];
2175	uint16_t uNewFs = uFrame.pu32[4];
2176	uint16_t uNewGs = uFrame.pu32[5];
2177	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2178	if (rcStrict != VINF_SUCCESS)
2179	return rcStrict;
2180
2181	/*
2182	* Commit the operation.
2183	*/
2184	uNewFlags &= X86_EFL_LIVE_MASK;
2185	uNewFlags \|= X86_EFL_RA1_MASK;
2186	#ifdef DBGFTRACE_ENABLED
2187	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2188	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2189	#endif
2190
2191	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2192	iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2193	iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2194	iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2195	iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2196	iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2197	iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2198	pCtx->rip = uNewEip;
2199	pCtx->rsp = uNewEsp;
2200	pIemCpu->uCpl = 3;
2201
2202	return VINF_SUCCESS;
2203	}
2204
2205
2206	/**
2207	* Implements iret for protected mode returning via a nested task.
2208	*
2209	* @param enmEffOpSize The effective operand size.
2210	*/
2211	IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2212	{
2213	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2214	}
2215
2216
2217	/**
2218	* Implements iret for protected mode
2219	*
2220	* @param enmEffOpSize The effective operand size.
2221	*/
2222	IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
2223	{
2224	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2225	NOREF(cbInstr);
2226
2227	/*
2228	* Nested task return.
2229	*/
2230	if (pCtx->eflags.Bits.u1NT)
2231	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
2232
2233	/*
2234	* Normal return.
2235	*
2236	* Do the stack bits, but don't commit RSP before everything checks
2237	* out right.
2238	*/
2239	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2240	VBOXSTRICTRC rcStrict;
2241	RTCPTRUNION uFrame;
2242	uint16_t uNewCs;
2243	uint32_t uNewEip;
2244	uint32_t uNewFlags;
2245	uint64_t uNewRsp;
2246	if (enmEffOpSize == IEMMODE_32BIT)
2247	{
2248	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2249	if (rcStrict != VINF_SUCCESS)
2250	return rcStrict;
2251	uNewEip = uFrame.pu32[0];
2252	uNewCs = (uint16_t)uFrame.pu32[1];
2253	uNewFlags = uFrame.pu32[2];
2254	}
2255	else
2256	{
2257	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2258	if (rcStrict != VINF_SUCCESS)
2259	return rcStrict;
2260	uNewEip = uFrame.pu16[0];
2261	uNewCs = uFrame.pu16[1];
2262	uNewFlags = uFrame.pu16[2];
2263	}
2264	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2265	if (rcStrict != VINF_SUCCESS)
2266	return rcStrict;
2267
2268	/*
2269	* We're hopefully not returning to V8086 mode...
2270	*/
2271	if ( (uNewFlags & X86_EFL_VM)
2272	&& pIemCpu->uCpl == 0)
2273	{
2274	Assert(enmEffOpSize == IEMMODE_32BIT);
2275	return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
2276	}
2277
2278	/*
2279	* Protected mode.
2280	*/
2281	/* Read the CS descriptor. */
2282	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2283	{
2284	Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
2285	return iemRaiseGeneralProtectionFault0(pIemCpu);
2286	}
2287
2288	IEMSELDESC DescCS;
2289	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
2290	if (rcStrict != VINF_SUCCESS)
2291	{
2292	Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
2293	return rcStrict;
2294	}
2295
2296	/* Must be a code descriptor. */
2297	if (!DescCS.Legacy.Gen.u1DescType)
2298	{
2299	Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2300	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2301	}
2302	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2303	{
2304	Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2305	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2306	}
2307
2308	/* Privilege checks. */
2309	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2310	{
2311	Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
2312	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2313	}
2314	if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2315	&& (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2316	{
2317	Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
2318	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2319	}
2320
2321	/* Present? */
2322	if (!DescCS.Legacy.Gen.u1Present)
2323	{
2324	Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
2325	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2326	}
2327
2328	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2329
2330	/*
2331	* Return to outer level?
2332	*/
2333	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
2334	{
2335	uint16_t uNewSS;
2336	uint32_t uNewESP;
2337	if (enmEffOpSize == IEMMODE_32BIT)
2338	{
2339	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2340	if (rcStrict != VINF_SUCCESS)
2341	return rcStrict;
2342	uNewESP = uFrame.pu32[0];
2343	uNewSS = (uint16_t)uFrame.pu32[1];
2344	}
2345	else
2346	{
2347	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2348	if (rcStrict != VINF_SUCCESS)
2349	return rcStrict;
2350	uNewESP = uFrame.pu16[0];
2351	uNewSS = uFrame.pu16[1];
2352	}
2353	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
2354	if (rcStrict != VINF_SUCCESS)
2355	return rcStrict;
2356
2357	/* Read the SS descriptor. */
2358	if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
2359	{
2360	Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
2361	return iemRaiseGeneralProtectionFault0(pIemCpu);
2362	}
2363
2364	IEMSELDESC DescSS;
2365	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
2366	if (rcStrict != VINF_SUCCESS)
2367	{
2368	Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
2369	uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
2370	return rcStrict;
2371	}
2372
2373	/* Privilege checks. */
2374	if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2375	{
2376	Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
2377	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2378	}
2379	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2380	{
2381	Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
2382	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
2383	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2384	}
2385
2386	/* Must be a writeable data segment descriptor. */
2387	if (!DescSS.Legacy.Gen.u1DescType)
2388	{
2389	Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
2390	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2391	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2392	}
2393	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2394	{
2395	Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
2396	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2397	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2398	}
2399
2400	/* Present? */
2401	if (!DescSS.Legacy.Gen.u1Present)
2402	{
2403	Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
2404	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
2405	}
2406
2407	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2408
2409	/* Check EIP. */
2410	if (uNewEip > cbLimitCS)
2411	{
2412	Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
2413	uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
2414	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2415	}
2416
2417	/*
2418	* Commit the changes, marking CS and SS accessed first since
2419	* that may fail.
2420	*/
2421	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2422	{
2423	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2424	if (rcStrict != VINF_SUCCESS)
2425	return rcStrict;
2426	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2427	}
2428	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2429	{
2430	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
2431	if (rcStrict != VINF_SUCCESS)
2432	return rcStrict;
2433	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2434	}
2435
2436	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2437	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2438	if (enmEffOpSize != IEMMODE_16BIT)
2439	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2440	if (pIemCpu->uCpl == 0)
2441	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
2442	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2443	fEFlagsMask \|= X86_EFL_IF;
2444	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2445	fEFlagsNew &= ~fEFlagsMask;
2446	fEFlagsNew \|= uNewFlags & fEFlagsMask;
2447	#ifdef DBGFTRACE_ENABLED
2448	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
2449	pIemCpu->uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
2450	uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
2451	#endif
2452
2453	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2454	pCtx->rip = uNewEip;
2455	pCtx->cs.Sel = uNewCs;
2456	pCtx->cs.ValidSel = uNewCs;
2457	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2458	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2459	pCtx->cs.u32Limit = cbLimitCS;
2460	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2461	if (!pCtx->cs.Attr.n.u1DefBig)
2462	pCtx->sp = (uint16_t)uNewESP;
2463	else
2464	pCtx->rsp = uNewESP;
2465	pCtx->ss.Sel = uNewSS;
2466	pCtx->ss.ValidSel = uNewSS;
2467	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2468	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2469	pCtx->ss.u32Limit = cbLimitSs;
2470	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2471
2472	pIemCpu->uCpl = uNewCs & X86_SEL_RPL;
2473	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2474	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2475	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2476	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2477
2478	/* Done! */
2479
2480	}
2481	/*
2482	* Return to the same level.
2483	*/
2484	else
2485	{
2486	/* Check EIP. */
2487	if (uNewEip > cbLimitCS)
2488	{
2489	Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
2490	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2491	}
2492
2493	/*
2494	* Commit the changes, marking CS first since it may fail.
2495	*/
2496	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2497	{
2498	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2499	if (rcStrict != VINF_SUCCESS)
2500	return rcStrict;
2501	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2502	}
2503
2504	X86EFLAGS NewEfl;
2505	NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2506	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2507	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2508	if (enmEffOpSize != IEMMODE_16BIT)
2509	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2510	if (pIemCpu->uCpl == 0)
2511	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
2512	else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
2513	fEFlagsMask \|= X86_EFL_IF;
2514	NewEfl.u &= ~fEFlagsMask;
2515	NewEfl.u \|= fEFlagsMask & uNewFlags;
2516	#ifdef DBGFTRACE_ENABLED
2517	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
2518	pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip,
2519	uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
2520	#endif
2521
2522	IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
2523	pCtx->rip = uNewEip;
2524	pCtx->cs.Sel = uNewCs;
2525	pCtx->cs.ValidSel = uNewCs;
2526	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2527	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2528	pCtx->cs.u32Limit = cbLimitCS;
2529	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2530	pCtx->rsp = uNewRsp;
2531	/* Done! */
2532	}
2533	return VINF_SUCCESS;
2534	}
2535
2536
2537	/**
2538	* Implements iret for long mode
2539	*
2540	* @param enmEffOpSize The effective operand size.
2541	*/
2542	IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
2543	{
2544	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2545	NOREF(cbInstr);
2546
2547	/*
2548	* Nested task return is not supported in long mode.
2549	*/
2550	if (pCtx->eflags.Bits.u1NT)
2551	{
2552	Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
2553	return iemRaiseGeneralProtectionFault0(pIemCpu);
2554	}
2555
2556	/*
2557	* Normal return.
2558	*
2559	* Do the stack bits, but don't commit RSP before everything checks
2560	* out right.
2561	*/
2562	VBOXSTRICTRC rcStrict;
2563	RTCPTRUNION uFrame;
2564	uint64_t uNewRip;
2565	uint16_t uNewCs;
2566	uint16_t uNewSs;
2567	uint32_t uNewFlags;
2568	uint64_t uNewRsp;
2569	if (enmEffOpSize == IEMMODE_64BIT)
2570	{
2571	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*8, &uFrame.pv, &uNewRsp);
2572	if (rcStrict != VINF_SUCCESS)
2573	return rcStrict;
2574	uNewRip = uFrame.pu64[0];
2575	uNewCs = (uint16_t)uFrame.pu64[1];
2576	uNewFlags = (uint32_t)uFrame.pu64[2];
2577	uNewRsp = uFrame.pu64[3];
2578	uNewSs = (uint16_t)uFrame.pu64[4];
2579	}
2580	else if (enmEffOpSize == IEMMODE_32BIT)
2581	{
2582	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*4, &uFrame.pv, &uNewRsp);
2583	if (rcStrict != VINF_SUCCESS)
2584	return rcStrict;
2585	uNewRip = uFrame.pu32[0];
2586	uNewCs = (uint16_t)uFrame.pu32[1];
2587	uNewFlags = uFrame.pu32[2];
2588	uNewRsp = uFrame.pu32[3];
2589	uNewSs = (uint16_t)uFrame.pu32[4];
2590	}
2591	else
2592	{
2593	Assert(enmEffOpSize == IEMMODE_16BIT);
2594	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*2, &uFrame.pv, &uNewRsp);
2595	if (rcStrict != VINF_SUCCESS)
2596	return rcStrict;
2597	uNewRip = uFrame.pu16[0];
2598	uNewCs = uFrame.pu16[1];
2599	uNewFlags = uFrame.pu16[2];
2600	uNewRsp = uFrame.pu16[3];
2601	uNewSs = uFrame.pu16[4];
2602	}
2603	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2604	if (rcStrict != VINF_SUCCESS)
2605	return rcStrict;
2606	Log2(("iretq stack: cs:rip=%04x:%016RX16 rflags=%016RX16 ss:rsp=%04x:%016RX16\n",
2607	uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
2608
2609	/*
2610	* Check stuff.
2611	*/
2612	/* Read the CS descriptor. */
2613	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2614	{
2615	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2616	return iemRaiseGeneralProtectionFault0(pIemCpu);
2617	}
2618
2619	IEMSELDESC DescCS;
2620	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
2621	if (rcStrict != VINF_SUCCESS)
2622	{
2623	Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
2624	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
2625	return rcStrict;
2626	}
2627
2628	/* Must be a code descriptor. */
2629	if ( !DescCS.Legacy.Gen.u1DescType
2630	\|\| !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2631	{
2632	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
2633	uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
2634	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2635	}
2636
2637	/* Privilege checks. */
2638	uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
2639	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2640	{
2641	Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp, pIemCpu->uCpl));
2642	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2643	}
2644	if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2645	&& (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2646	{
2647	Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < DPL (%d) -> #GP\n",
2648	uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u2Dpl));
2649	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2650	}
2651
2652	/* Present? */
2653	if (!DescCS.Legacy.Gen.u1Present)
2654	{
2655	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2656	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2657	}
2658
2659	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2660
2661	/* Read the SS descriptor. */
2662	IEMSELDESC DescSS;
2663	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2664	{
2665	if ( !DescCS.Legacy.Gen.u1Long
2666	\|\| DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
2667	\|\| uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
2668	{
2669	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2670	return iemRaiseGeneralProtectionFault0(pIemCpu);
2671	}
2672	DescSS.Legacy.u = 0;
2673	}
2674	else
2675	{
2676	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
2677	if (rcStrict != VINF_SUCCESS)
2678	{
2679	Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
2680	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
2681	return rcStrict;
2682	}
2683	}
2684
2685	/* Privilege checks. */
2686	if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2687	{
2688	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2689	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2690	}
2691
2692	uint32_t cbLimitSs;
2693	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2694	cbLimitSs = UINT32_MAX;
2695	else
2696	{
2697	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2698	{
2699	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
2700	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
2701	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2702	}
2703
2704	/* Must be a writeable data segment descriptor. */
2705	if (!DescSS.Legacy.Gen.u1DescType)
2706	{
2707	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
2708	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
2709	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2710	}
2711	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2712	{
2713	Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
2714	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
2715	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2716	}
2717
2718	/* Present? */
2719	if (!DescSS.Legacy.Gen.u1Present)
2720	{
2721	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2722	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSs);
2723	}
2724	cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2725	}
2726
2727	/* Check EIP. */
2728	if (DescCS.Legacy.Gen.u1Long)
2729	{
2730	if (!IEM_IS_CANONICAL(uNewRip))
2731	{
2732	Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
2733	uNewCs, uNewRip, uNewSs, uNewRsp));
2734	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2735	}
2736	}
2737	else
2738	{
2739	if (uNewRip > cbLimitCS)
2740	{
2741	Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
2742	uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
2743	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2744	}
2745	}
2746
2747	/*
2748	* Commit the changes, marking CS and SS accessed first since
2749	* that may fail.
2750	*/
2751	/** @todo where exactly are these actually marked accessed by a real CPU? */
2752	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2753	{
2754	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2755	if (rcStrict != VINF_SUCCESS)
2756	return rcStrict;
2757	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2758	}
2759	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2760	{
2761	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSs);
2762	if (rcStrict != VINF_SUCCESS)
2763	return rcStrict;
2764	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2765	}
2766
2767	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2768	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2769	if (enmEffOpSize != IEMMODE_16BIT)
2770	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2771	if (pIemCpu->uCpl == 0)
2772	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is ignored */
2773	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2774	fEFlagsMask \|= X86_EFL_IF;
2775	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2776	fEFlagsNew &= ~fEFlagsMask;
2777	fEFlagsNew \|= uNewFlags & fEFlagsMask;
2778	#ifdef DBGFTRACE_ENABLED
2779	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
2780	pIemCpu->uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
2781	#endif
2782
2783	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2784	pCtx->rip = uNewRip;
2785	pCtx->cs.Sel = uNewCs;
2786	pCtx->cs.ValidSel = uNewCs;
2787	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2788	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2789	pCtx->cs.u32Limit = cbLimitCS;
2790	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2791	if (pCtx->cs.Attr.n.u1Long \|\| pCtx->cs.Attr.n.u1DefBig)
2792	pCtx->rsp = uNewRsp;
2793	else
2794	pCtx->sp = (uint16_t)uNewRsp;
2795	pCtx->ss.Sel = uNewSs;
2796	pCtx->ss.ValidSel = uNewSs;
2797	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2798	{
2799	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2800	pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE \| (uNewCpl << X86DESCATTR_DPL_SHIFT);
2801	pCtx->ss.u32Limit = UINT32_MAX;
2802	pCtx->ss.u64Base = 0;
2803	Log2(("iretq new SS: NULL\n"));
2804	}
2805	else
2806	{
2807	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2808	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2809	pCtx->ss.u32Limit = cbLimitSs;
2810	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2811	Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
2812	}
2813
2814	if (pIemCpu->uCpl != uNewCpl)
2815	{
2816	pIemCpu->uCpl = uNewCpl;
2817	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->ds);
2818	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->es);
2819	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->fs);
2820	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->gs);
2821	}
2822
2823	return VINF_SUCCESS;
2824	}
2825
2826
2827	/**
2828	* Implements iret.
2829	*
2830	* @param enmEffOpSize The effective operand size.
2831	*/
2832	IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
2833	{
2834	/*
2835	* Call a mode specific worker.
2836	*/
2837	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2838	return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
2839	if (IEM_IS_LONG_MODE(pIemCpu))
2840	return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
2841
2842	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
2843	}
2844
2845
2846	/**
2847	* Implements SYSCALL (AMD and Intel64).
2848	*
2849	* @param enmEffOpSize The effective operand size.
2850	*/
2851	IEM_CIMPL_DEF_0(iemCImpl_syscall)
2852	{
2853	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2854
2855	/*
2856	* Check preconditions.
2857	*
2858	* Note that CPUs described in the documentation may load a few odd values
2859	* into CS and SS than we allow here. This has yet to be checked on real
2860	* hardware.
2861	*/
2862	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
2863	{
2864	Log(("syscall: Not enabled in EFER -> #UD\n"));
2865	return iemRaiseUndefinedOpcode(pIemCpu);
2866	}
2867	if (!(pCtx->cr0 & X86_CR0_PE))
2868	{
2869	Log(("syscall: Protected mode is required -> #GP(0)\n"));
2870	return iemRaiseGeneralProtectionFault0(pIemCpu);
2871	}
2872	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
2873	{
2874	Log(("syscall: Only available in long mode on intel -> #UD\n"));
2875	return iemRaiseUndefinedOpcode(pIemCpu);
2876	}
2877
2878	/** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
2879	/** @todo what about LDT selectors? Shouldn't matter, really. */
2880	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
2881	uint16_t uNewSs = uNewCs + 8;
2882	if (uNewCs == 0 \|\| uNewSs == 0)
2883	{
2884	Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
2885	return iemRaiseGeneralProtectionFault0(pIemCpu);
2886	}
2887
2888	/* Long mode and legacy mode differs. */
2889	if (CPUMIsGuestInLongModeEx(pCtx))
2890	{
2891	uint64_t uNewRip = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
2892
2893	/* This test isn't in the docs, but I'm not trusting the guys writing
2894	the MSRs to have validated the values as canonical like they should. */
2895	if (!IEM_IS_CANONICAL(uNewRip))
2896	{
2897	Log(("syscall: Only available in long mode on intel -> #UD\n"));
2898	return iemRaiseUndefinedOpcode(pIemCpu);
2899	}
2900
2901	/*
2902	* Commit it.
2903	*/
2904	Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
2905	pCtx->rcx = pCtx->rip + cbInstr;
2906	pCtx->rip = uNewRip;
2907
2908	pCtx->rflags.u &= ~X86_EFL_RF;
2909	pCtx->r11 = pCtx->rflags.u;
2910	pCtx->rflags.u &= ~pCtx->msrSFMASK;
2911	pCtx->rflags.u \|= X86_EFL_1;
2912
2913	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
2914	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
2915	}
2916	else
2917	{
2918	/*
2919	* Commit it.
2920	*/
2921	Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
2922	pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
2923	pCtx->rcx = pCtx->eip + cbInstr;
2924	pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
2925	pCtx->rflags.u &= ~(X86_EFL_VM \| X86_EFL_IF \| X86_EFL_RF);
2926
2927	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
2928	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
2929	}
2930	pCtx->cs.Sel = uNewCs;
2931	pCtx->cs.ValidSel = uNewCs;
2932	pCtx->cs.u64Base = 0;
2933	pCtx->cs.u32Limit = UINT32_MAX;
2934	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2935
2936	pCtx->ss.Sel = uNewSs;
2937	pCtx->ss.ValidSel = uNewSs;
2938	pCtx->ss.u64Base = 0;
2939	pCtx->ss.u32Limit = UINT32_MAX;
2940	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2941
2942	return VINF_SUCCESS;
2943	}
2944
2945
2946	/**
2947	* Implements SYSRET (AMD and Intel64).
2948	*/
2949	IEM_CIMPL_DEF_0(iemCImpl_sysret)
2950
2951	{
2952	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2953
2954	/*
2955	* Check preconditions.
2956	*
2957	* Note that CPUs described in the documentation may load a few odd values
2958	* into CS and SS than we allow here. This has yet to be checked on real
2959	* hardware.
2960	*/
2961	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
2962	{
2963	Log(("sysret: Not enabled in EFER -> #UD\n"));
2964	return iemRaiseUndefinedOpcode(pIemCpu);
2965	}
2966	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
2967	{
2968	Log(("sysret: Only available in long mode on intel -> #UD\n"));
2969	return iemRaiseUndefinedOpcode(pIemCpu);
2970	}
2971	if (!(pCtx->cr0 & X86_CR0_PE))
2972	{
2973	Log(("sysret: Protected mode is required -> #GP(0)\n"));
2974	return iemRaiseGeneralProtectionFault0(pIemCpu);
2975	}
2976	if (pIemCpu->uCpl != 0)
2977	{
2978	Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pIemCpu->uCpl));
2979	return iemRaiseGeneralProtectionFault0(pIemCpu);
2980	}
2981
2982	/** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
2983	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
2984	uint16_t uNewSs = uNewCs + 8;
2985	if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
2986	uNewCs += 16;
2987	if (uNewCs == 0 \|\| uNewSs == 0)
2988	{
2989	Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
2990	return iemRaiseGeneralProtectionFault0(pIemCpu);
2991	}
2992
2993	/*
2994	* Commit it.
2995	*/
2996	if (CPUMIsGuestInLongModeEx(pCtx))
2997	{
2998	if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
2999	{
3000	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
3001	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
3002	/* Note! We disregard intel manual regarding the RCX cananonical
3003	check, ask intel+xen why AMD doesn't do it. */
3004	pCtx->rip = pCtx->rcx;
3005	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3006	\| (3 << X86DESCATTR_DPL_SHIFT);
3007	}
3008	else
3009	{
3010	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
3011	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
3012	pCtx->rip = pCtx->ecx;
3013	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3014	\| (3 << X86DESCATTR_DPL_SHIFT);
3015	}
3016	/** @todo testcase: See what kind of flags we can make SYSRET restore and
3017	* what it really ignores. RF and VM are hinted at being zero, by AMD. */
3018	pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS \| X86_EFL_VIF \| X86_EFL_VIP);
3019	pCtx->rflags.u \|= X86_EFL_1;
3020	}
3021	else
3022	{
3023	Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
3024	pCtx->rip = pCtx->rcx;
3025	pCtx->rflags.u \|= X86_EFL_IF;
3026	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3027	\| (3 << X86DESCATTR_DPL_SHIFT);
3028	}
3029	pCtx->cs.Sel = uNewCs \| 3;
3030	pCtx->cs.ValidSel = uNewCs \| 3;
3031	pCtx->cs.u64Base = 0;
3032	pCtx->cs.u32Limit = UINT32_MAX;
3033	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3034
3035	pCtx->ss.Sel = uNewSs \| 3;
3036	pCtx->ss.ValidSel = uNewSs \| 3;
3037	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3038	/* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
3039	pCtx->ss.Attr.u \|= (3 << X86DESCATTR_DPL_SHIFT);
3040	/** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
3041	* on sysret. */
3042
3043	return VINF_SUCCESS;
3044	}
3045
3046
3047	/**
3048	* Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
3049	*
3050	* @param iSegReg The segment register number (valid).
3051	* @param uSel The new selector value.
3052	*/
3053	IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
3054	{
3055	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
3056	uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
3057	PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
3058
3059	Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
3060
3061	/*
3062	* Real mode and V8086 mode are easy.
3063	*/
3064	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
3065	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3066	{
3067	*pSel = uSel;
3068	pHid->u64Base = (uint32_t)uSel << 4;
3069	pHid->ValidSel = uSel;
3070	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3071	#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
3072	/** @todo Does the CPU actually load limits and attributes in the
3073	* real/V8086 mode segment load case? It doesn't for CS in far
3074	* jumps... Affects unreal mode. */
3075	pHid->u32Limit = 0xffff;
3076	pHid->Attr.u = 0;
3077	pHid->Attr.n.u1Present = 1;
3078	pHid->Attr.n.u1DescType = 1;
3079	pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
3080	? X86_SEL_TYPE_RW
3081	: X86_SEL_TYPE_READ \| X86_SEL_TYPE_CODE;
3082	#endif
3083	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3084	iemRegAddToRip(pIemCpu, cbInstr);
3085	return VINF_SUCCESS;
3086	}
3087
3088	/*
3089	* Protected mode.
3090	*
3091	* Check if it's a null segment selector value first, that's OK for DS, ES,
3092	* FS and GS. If not null, then we have to load and parse the descriptor.
3093	*/
3094	if (!(uSel & X86_SEL_MASK_OFF_RPL))
3095	{
3096	Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
3097	if (iSegReg == X86_SREG_SS)
3098	{
3099	/* In 64-bit kernel mode, the stack can be 0 because of the way
3100	interrupts are dispatched. AMD seems to have a slighly more
3101	relaxed relationship to SS.RPL than intel does. */
3102	/** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
3103	if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
3104	\|\| pIemCpu->uCpl > 2
3105	\|\| ( uSel != pIemCpu->uCpl
3106	&& !IEM_IS_GUEST_CPU_AMD(pIemCpu)) )
3107	{
3108	Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
3109	return iemRaiseGeneralProtectionFault0(pIemCpu);
3110	}
3111	}
3112
3113	pSel = uSel; / Not RPL, remember :-) */
3114	iemHlpLoadNullDataSelectorProt(pHid, uSel);
3115	if (iSegReg == X86_SREG_SS)
3116	pHid->Attr.u \|= pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT;
3117
3118	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3119	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3120
3121	iemRegAddToRip(pIemCpu, cbInstr);
3122	return VINF_SUCCESS;
3123	}
3124
3125	/* Fetch the descriptor. */
3126	IEMSELDESC Desc;
3127	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
3128	if (rcStrict != VINF_SUCCESS)
3129	return rcStrict;
3130
3131	/* Check GPs first. */
3132	if (!Desc.Legacy.Gen.u1DescType)
3133	{
3134	Log(("load sreg %d - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
3135	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3136	}
3137	if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
3138	{
3139	if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
3140	\|\| !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
3141	{
3142	Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
3143	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3144	}
3145	if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
3146	{
3147	Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
3148	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3149	}
3150	if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
3151	{
3152	Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
3153	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3154	}
3155	}
3156	else
3157	{
3158	if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3159	{
3160	Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
3161	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3162	}
3163	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3164	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3165	{
3166	#if 0 /* this is what intel says. */
3167	if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
3168	&& pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3169	{
3170	Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
3171	iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3172	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3173	}
3174	#else /* this is what makes more sense. */
3175	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3176	{
3177	Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
3178	iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
3179	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3180	}
3181	if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3182	{
3183	Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
3184	iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3185	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3186	}
3187	#endif
3188	}
3189	}
3190
3191	/* Is it there? */
3192	if (!Desc.Legacy.Gen.u1Present)
3193	{
3194	Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
3195	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
3196	}
3197
3198	/* The base and limit. */
3199	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
3200	uint64_t u64Base;
3201	if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
3202	&& iSegReg < X86_SREG_FS)
3203	u64Base = 0;
3204	else
3205	u64Base = X86DESC_BASE(&Desc.Legacy);
3206
3207	/*
3208	* Ok, everything checked out fine. Now set the accessed bit before
3209	* committing the result into the registers.
3210	*/
3211	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3212	{
3213	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
3214	if (rcStrict != VINF_SUCCESS)
3215	return rcStrict;
3216	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3217	}
3218
3219	/* commit */
3220	*pSel = uSel;
3221	pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3222	pHid->u32Limit = cbLimit;
3223	pHid->u64Base = u64Base;
3224	pHid->ValidSel = uSel;
3225	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3226
3227	/** @todo check if the hidden bits are loaded correctly for 64-bit
3228	* mode. */
3229	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3230
3231	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3232	iemRegAddToRip(pIemCpu, cbInstr);
3233	return VINF_SUCCESS;
3234	}
3235
3236
3237	/**
3238	* Implements 'mov SReg, r/m'.
3239	*
3240	* @param iSegReg The segment register number (valid).
3241	* @param uSel The new selector value.
3242	*/
3243	IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
3244	{
3245	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3246	if (rcStrict == VINF_SUCCESS)
3247	{
3248	if (iSegReg == X86_SREG_SS)
3249	{
3250	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3251	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3252	}
3253	}
3254	return rcStrict;
3255	}
3256
3257
3258	/**
3259	* Implements 'pop SReg'.
3260	*
3261	* @param iSegReg The segment register number (valid).
3262	* @param enmEffOpSize The efficient operand size (valid).
3263	*/
3264	IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
3265	{
3266	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3267	VBOXSTRICTRC rcStrict;
3268
3269	/*
3270	* Read the selector off the stack and join paths with mov ss, reg.
3271	*/
3272	RTUINT64U TmpRsp;
3273	TmpRsp.u = pCtx->rsp;
3274	switch (enmEffOpSize)
3275	{
3276	case IEMMODE_16BIT:
3277	{
3278	uint16_t uSel;
3279	rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
3280	if (rcStrict == VINF_SUCCESS)
3281	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3282	break;
3283	}
3284
3285	case IEMMODE_32BIT:
3286	{
3287	uint32_t u32Value;
3288	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
3289	if (rcStrict == VINF_SUCCESS)
3290	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
3291	break;
3292	}
3293
3294	case IEMMODE_64BIT:
3295	{
3296	uint64_t u64Value;
3297	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
3298	if (rcStrict == VINF_SUCCESS)
3299	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
3300	break;
3301	}
3302	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3303	}
3304
3305	/*
3306	* Commit the stack on success.
3307	*/
3308	if (rcStrict == VINF_SUCCESS)
3309	{
3310	pCtx->rsp = TmpRsp.u;
3311	if (iSegReg == X86_SREG_SS)
3312	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3313	}
3314	return rcStrict;
3315	}
3316
3317
3318	/**
3319	* Implements lgs, lfs, les, lds & lss.
3320	*/
3321	IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
3322	uint16_t, uSel,
3323	uint64_t, offSeg,
3324	uint8_t, iSegReg,
3325	uint8_t, iGReg,
3326	IEMMODE, enmEffOpSize)
3327	{
3328	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
3329	VBOXSTRICTRC rcStrict;
3330
3331	/*
3332	* Use iemCImpl_LoadSReg to do the tricky segment register loading.
3333	*/
3334	/** @todo verify and test that mov, pop and lXs works the segment
3335	* register loading in the exact same way. */
3336	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3337	if (rcStrict == VINF_SUCCESS)
3338	{
3339	switch (enmEffOpSize)
3340	{
3341	case IEMMODE_16BIT:
3342	(uint16_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3343	break;
3344	case IEMMODE_32BIT:
3345	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3346	break;
3347	case IEMMODE_64BIT:
3348	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3349	break;
3350	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3351	}
3352	}
3353
3354	return rcStrict;
3355	}
3356
3357
3358	/**
3359	* Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
3360	*
3361	* @retval VINF_SUCCESS on success.
3362	* @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
3363	* @retval iemMemFetchSysU64 return value.
3364	*
3365	* @param pIemCpu The IEM state of the calling EMT.
3366	* @param uSel The selector value.
3367	* @param fAllowSysDesc Whether system descriptors are OK or not.
3368	* @param pDesc Where to return the descriptor on success.
3369	*/
3370	static VBOXSTRICTRC iemCImpl_LoadDescHelper(PIEMCPU pIemCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
3371	{
3372	pDesc->Long.au64[0] = 0;
3373	pDesc->Long.au64[1] = 0;
3374
3375	if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
3376	return VINF_IEM_SELECTOR_NOT_OK;
3377
3378	/* Within the table limits? */
3379	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3380	RTGCPTR GCPtrBase;
3381	if (uSel & X86_SEL_LDT)
3382	{
3383	if ( !pCtx->ldtr.Attr.n.u1Present
3384	\|\| (uSel \| X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
3385	return VINF_IEM_SELECTOR_NOT_OK;
3386	GCPtrBase = pCtx->ldtr.u64Base;
3387	}
3388	else
3389	{
3390	if ((uSel \| X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
3391	return VINF_IEM_SELECTOR_NOT_OK;
3392	GCPtrBase = pCtx->gdtr.pGdt;
3393	}
3394
3395	/* Fetch the descriptor. */
3396	VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
3397	if (rcStrict != VINF_SUCCESS)
3398	return rcStrict;
3399	if (!pDesc->Legacy.Gen.u1DescType)
3400	{
3401	if (!fAllowSysDesc)
3402	return VINF_IEM_SELECTOR_NOT_OK;
3403	if (CPUMIsGuestInLongModeEx(pCtx))
3404	{
3405	rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
3406	if (rcStrict != VINF_SUCCESS)
3407	return rcStrict;
3408	}
3409
3410	}
3411
3412	return VINF_SUCCESS;
3413	}
3414
3415
3416	/**
3417	* Implements verr (fWrite = false) and verw (fWrite = true).
3418	*/
3419	IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
3420	{
3421	Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
3422
3423	/** @todo figure whether the accessed bit is set or not. */
3424
3425	bool fAccessible = true;
3426	IEMSELDESC Desc;
3427	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /fAllowSysDesc/, &Desc);
3428	if (rcStrict == VINF_SUCCESS)
3429	{
3430	/* Check the descriptor, order doesn't matter much here. */
3431	if ( !Desc.Legacy.Gen.u1DescType
3432	\|\| !Desc.Legacy.Gen.u1Present)
3433	fAccessible = false;
3434	else
3435	{
3436	if ( fWrite
3437	? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
3438	: (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3439	fAccessible = false;
3440
3441	/** @todo testcase for the conforming behavior. */
3442	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3443	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3444	{
3445	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3446	fAccessible = false;
3447	else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3448	fAccessible = false;
3449	}
3450	}
3451
3452	}
3453	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
3454	fAccessible = false;
3455	else
3456	return rcStrict;
3457
3458	/* commit */
3459	pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
3460
3461	iemRegAddToRip(pIemCpu, cbInstr);
3462	return VINF_SUCCESS;
3463	}
3464
3465
3466	/**
3467	* Implements LAR and LSL with 64-bit operand size.
3468	*
3469	* @returns VINF_SUCCESS.
3470	* @param pu16Dst Pointer to the destination register.
3471	* @param uSel The selector to load details for.
3472	* @param pEFlags Pointer to the eflags register.
3473	* @param fIsLar true = LAR, false = LSL.
3474	*/
3475	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t , pu64Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
3476	{
3477	Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
3478
3479	/** @todo figure whether the accessed bit is set or not. */
3480
3481	bool fDescOk = true;
3482	IEMSELDESC Desc;
3483	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /fAllowSysDesc/, &Desc);
3484	if (rcStrict == VINF_SUCCESS)
3485	{
3486	/*
3487	* Check the descriptor type.
3488	*/
3489	if (!Desc.Legacy.Gen.u1DescType)
3490	{
3491	if (CPUMIsGuestInLongModeEx(pIemCpu->CTX_SUFF(pCtx)))
3492	{
3493	if (Desc.Long.Gen.u5Zeros)
3494	fDescOk = false;
3495	else
3496	switch (Desc.Long.Gen.u4Type)
3497	{
3498	/** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
3499	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
3500	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
3501	case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
3502	break;
3503	case AMD64_SEL_TYPE_SYS_CALL_GATE:
3504	fDescOk = fIsLar;
3505	break;
3506	default:
3507	fDescOk = false;
3508	break;
3509	}
3510	}
3511	else
3512	{
3513	switch (Desc.Long.Gen.u4Type)
3514	{
3515	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
3516	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
3517	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
3518	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
3519	case X86_SEL_TYPE_SYS_LDT:
3520	break;
3521	case X86_SEL_TYPE_SYS_286_CALL_GATE:
3522	case X86_SEL_TYPE_SYS_TASK_GATE:
3523	case X86_SEL_TYPE_SYS_386_CALL_GATE:
3524	fDescOk = fIsLar;
3525	break;
3526	default:
3527	fDescOk = false;
3528	break;
3529	}
3530	}
3531	}
3532	if (fDescOk)
3533	{
3534	/*
3535	* Check the RPL/DPL/CPL interaction..
3536	*/
3537	/** @todo testcase for the conforming behavior. */
3538	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)
3539	\|\| !Desc.Legacy.Gen.u1DescType)
3540	{
3541	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3542	fDescOk = false;
3543	else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3544	fDescOk = false;
3545	}
3546	}
3547
3548	if (fDescOk)
3549	{
3550	/*
3551	* All fine, start committing the result.
3552	*/
3553	if (fIsLar)
3554	*pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
3555	else
3556	*pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
3557	}
3558
3559	}
3560	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
3561	fDescOk = false;
3562	else
3563	return rcStrict;
3564
3565	/* commit flags value and advance rip. */
3566	pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
3567	iemRegAddToRip(pIemCpu, cbInstr);
3568
3569	return VINF_SUCCESS;
3570	}
3571
3572
3573	/**
3574	* Implements LAR and LSL with 16-bit operand size.
3575	*
3576	* @returns VINF_SUCCESS.
3577	* @param pu16Dst Pointer to the destination register.
3578	* @param u16Sel The selector to load details for.
3579	* @param pEFlags Pointer to the eflags register.
3580	* @param fIsLar true = LAR, false = LSL.
3581	*/
3582	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u16, uint16_t , pu16Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
3583	{
3584	uint64_t u64TmpDst = *pu16Dst;
3585	IEM_CIMPL_CALL_4(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, pEFlags, fIsLar);
3586	*pu16Dst = (uint16_t)u64TmpDst;
3587	return VINF_SUCCESS;
3588	}
3589
3590
3591	/**
3592	* Implements lgdt.
3593	*
3594	* @param iEffSeg The segment of the new gdtr contents
3595	* @param GCPtrEffSrc The address of the new gdtr contents.
3596	* @param enmEffOpSize The effective operand size.
3597	*/
3598	IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
3599	{
3600	if (pIemCpu->uCpl != 0)
3601	return iemRaiseGeneralProtectionFault0(pIemCpu);
3602	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3603
3604	/*
3605	* Fetch the limit and base address.
3606	*/
3607	uint16_t cbLimit;
3608	RTGCPTR GCPtrBase;
3609	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
3610	if (rcStrict == VINF_SUCCESS)
3611	{
3612	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3613	rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
3614	else
3615	{
3616	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3617	pCtx->gdtr.cbGdt = cbLimit;
3618	pCtx->gdtr.pGdt = GCPtrBase;
3619	}
3620	if (rcStrict == VINF_SUCCESS)
3621	iemRegAddToRip(pIemCpu, cbInstr);
3622	}
3623	return rcStrict;
3624	}
3625
3626
3627	/**
3628	* Implements sgdt.
3629	*
3630	* @param iEffSeg The segment where to store the gdtr content.
3631	* @param GCPtrEffDst The address where to store the gdtr content.
3632	* @param enmEffOpSize The effective operand size.
3633	*/
3634	IEM_CIMPL_DEF_3(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
3635	{
3636	/*
3637	* Join paths with sidt.
3638	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
3639	* you really must know.
3640	*/
3641	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3642	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
3643	if (rcStrict == VINF_SUCCESS)
3644	iemRegAddToRip(pIemCpu, cbInstr);
3645	return rcStrict;
3646	}
3647
3648
3649	/**
3650	* Implements lidt.
3651	*
3652	* @param iEffSeg The segment of the new idtr contents
3653	* @param GCPtrEffSrc The address of the new idtr contents.
3654	* @param enmEffOpSize The effective operand size.
3655	*/
3656	IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
3657	{
3658	if (pIemCpu->uCpl != 0)
3659	return iemRaiseGeneralProtectionFault0(pIemCpu);
3660	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3661
3662	/*
3663	* Fetch the limit and base address.
3664	*/
3665	uint16_t cbLimit;
3666	RTGCPTR GCPtrBase;
3667	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
3668	if (rcStrict == VINF_SUCCESS)
3669	{
3670	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3671	CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
3672	else
3673	{
3674	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3675	pCtx->idtr.cbIdt = cbLimit;
3676	pCtx->idtr.pIdt = GCPtrBase;
3677	}
3678	iemRegAddToRip(pIemCpu, cbInstr);
3679	}
3680	return rcStrict;
3681	}
3682
3683
3684	/**
3685	* Implements sidt.
3686	*
3687	* @param iEffSeg The segment where to store the idtr content.
3688	* @param GCPtrEffDst The address where to store the idtr content.
3689	* @param enmEffOpSize The effective operand size.
3690	*/
3691	IEM_CIMPL_DEF_3(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
3692	{
3693	/*
3694	* Join paths with sgdt.
3695	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
3696	* you really must know.
3697	*/
3698	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3699	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
3700	if (rcStrict == VINF_SUCCESS)
3701	iemRegAddToRip(pIemCpu, cbInstr);
3702	return rcStrict;
3703	}
3704
3705
3706	/**
3707	* Implements lldt.
3708	*
3709	* @param uNewLdt The new LDT selector value.
3710	*/
3711	IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
3712	{
3713	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3714
3715	/*
3716	* Check preconditions.
3717	*/
3718	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3719	{
3720	Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
3721	return iemRaiseUndefinedOpcode(pIemCpu);
3722	}
3723	if (pIemCpu->uCpl != 0)
3724	{
3725	Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
3726	return iemRaiseGeneralProtectionFault0(pIemCpu);
3727	}
3728	if (uNewLdt & X86_SEL_LDT)
3729	{
3730	Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
3731	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
3732	}
3733
3734	/*
3735	* Now, loading a NULL selector is easy.
3736	*/
3737	if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
3738	{
3739	Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
3740	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3741	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
3742	else
3743	pCtx->ldtr.Sel = uNewLdt;
3744	pCtx->ldtr.ValidSel = uNewLdt;
3745	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3746	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
3747	if (!IEM_IS_GUEST_CPU_AMD(pIemCpu) \|\| !IEM_VERIFICATION_ENABLED(pIemCpu)) /* See bs-cpu-hidden-regs-1 on AMD. */
3748	{
3749	pCtx->ldtr.u64Base = 0;
3750	pCtx->ldtr.u32Limit = 0;
3751	}
3752
3753	iemRegAddToRip(pIemCpu, cbInstr);
3754	return VINF_SUCCESS;
3755	}
3756
3757	/*
3758	* Read the descriptor.
3759	*/
3760	IEMSELDESC Desc;
3761	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
3762	if (rcStrict != VINF_SUCCESS)
3763	return rcStrict;
3764
3765	/* Check GPs first. */
3766	if (Desc.Legacy.Gen.u1DescType)
3767	{
3768	Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
3769	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3770	}
3771	if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
3772	{
3773	Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
3774	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3775	}
3776	uint64_t u64Base;
3777	if (!IEM_IS_LONG_MODE(pIemCpu))
3778	u64Base = X86DESC_BASE(&Desc.Legacy);
3779	else
3780	{
3781	if (Desc.Long.Gen.u5Zeros)
3782	{
3783	Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
3784	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3785	}
3786
3787	u64Base = X86DESC64_BASE(&Desc.Long);
3788	if (!IEM_IS_CANONICAL(u64Base))
3789	{
3790	Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
3791	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3792	}
3793	}
3794
3795	/* NP */
3796	if (!Desc.Legacy.Gen.u1Present)
3797	{
3798	Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
3799	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
3800	}
3801
3802	/*
3803	* It checks out alright, update the registers.
3804	*/
3805	/** @todo check if the actual value is loaded or if the RPL is dropped */
3806	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3807	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
3808	else
3809	pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3810	pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3811	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3812	pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3813	pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3814	pCtx->ldtr.u64Base = u64Base;
3815
3816	iemRegAddToRip(pIemCpu, cbInstr);
3817	return VINF_SUCCESS;
3818	}
3819
3820
3821	/**
3822	* Implements lldt.
3823	*
3824	* @param uNewLdt The new LDT selector value.
3825	*/
3826	IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
3827	{
3828	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3829
3830	/*
3831	* Check preconditions.
3832	*/
3833	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3834	{
3835	Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
3836	return iemRaiseUndefinedOpcode(pIemCpu);
3837	}
3838	if (pIemCpu->uCpl != 0)
3839	{
3840	Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
3841	return iemRaiseGeneralProtectionFault0(pIemCpu);
3842	}
3843	if (uNewTr & X86_SEL_LDT)
3844	{
3845	Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
3846	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
3847	}
3848	if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
3849	{
3850	Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
3851	return iemRaiseGeneralProtectionFault0(pIemCpu);
3852	}
3853
3854	/*
3855	* Read the descriptor.
3856	*/
3857	IEMSELDESC Desc;
3858	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
3859	if (rcStrict != VINF_SUCCESS)
3860	return rcStrict;
3861
3862	/* Check GPs first. */
3863	if (Desc.Legacy.Gen.u1DescType)
3864	{
3865	Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3866	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3867	}
3868	if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
3869	&& ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
3870	\|\| IEM_IS_LONG_MODE(pIemCpu)) )
3871	{
3872	Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3873	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3874	}
3875	uint64_t u64Base;
3876	if (!IEM_IS_LONG_MODE(pIemCpu))
3877	u64Base = X86DESC_BASE(&Desc.Legacy);
3878	else
3879	{
3880	if (Desc.Long.Gen.u5Zeros)
3881	{
3882	Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
3883	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3884	}
3885
3886	u64Base = X86DESC64_BASE(&Desc.Long);
3887	if (!IEM_IS_CANONICAL(u64Base))
3888	{
3889	Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
3890	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3891	}
3892	}
3893
3894	/* NP */
3895	if (!Desc.Legacy.Gen.u1Present)
3896	{
3897	Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
3898	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
3899	}
3900
3901	/*
3902	* Set it busy.
3903	* Note! Intel says this should lock down the whole descriptor, but we'll
3904	* restrict our selves to 32-bit for now due to lack of inline
3905	* assembly and such.
3906	*/
3907	void *pvDesc;
3908	rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
3909	if (rcStrict != VINF_SUCCESS)
3910	return rcStrict;
3911	switch ((uintptr_t)pvDesc & 3)
3912	{
3913	case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
3914	case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
3915	case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
3916	case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
3917	}
3918	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvDesc, IEM_ACCESS_DATA_RW);
3919	if (rcStrict != VINF_SUCCESS)
3920	return rcStrict;
3921	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
3922
3923	/*
3924	* It checks out alright, update the registers.
3925	*/
3926	/** @todo check if the actual value is loaded or if the RPL is dropped */
3927	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3928	CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
3929	else
3930	pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
3931	pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
3932	pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
3933	pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3934	pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3935	pCtx->tr.u64Base = u64Base;
3936
3937	iemRegAddToRip(pIemCpu, cbInstr);
3938	return VINF_SUCCESS;
3939	}
3940
3941
3942	/**
3943	* Implements mov GReg,CRx.
3944	*
3945	* @param iGReg The general register to store the CRx value in.
3946	* @param iCrReg The CRx register to read (valid).
3947	*/
3948	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
3949	{
3950	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3951	if (pIemCpu->uCpl != 0)
3952	return iemRaiseGeneralProtectionFault0(pIemCpu);
3953	Assert(!pCtx->eflags.Bits.u1VM);
3954
3955	/* read it */
3956	uint64_t crX;
3957	switch (iCrReg)
3958	{
3959	case 0: crX = pCtx->cr0; break;
3960	case 2: crX = pCtx->cr2; break;
3961	case 3: crX = pCtx->cr3; break;
3962	case 4: crX = pCtx->cr4; break;
3963	case 8:
3964	{
3965	uint8_t uTpr;
3966	int rc = PDMApicGetTPR(IEMCPU_TO_VMCPU(pIemCpu), &uTpr, NULL, NULL);
3967	if (RT_SUCCESS(rc))
3968	crX = uTpr >> 4;
3969	else
3970	crX = 0;
3971	break;
3972	}
3973	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
3974	}
3975
3976	/* store it */
3977	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3978	(uint64_t )iemGRegRef(pIemCpu, iGReg) = crX;
3979	else
3980	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
3981
3982	iemRegAddToRip(pIemCpu, cbInstr);
3983	return VINF_SUCCESS;
3984	}
3985
3986
3987	/**
3988	* Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
3989	*
3990	* @param iCrReg The CRx register to write (valid).
3991	* @param uNewCrX The new value.
3992	*/
3993	IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
3994	{
3995	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3996	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3997	VBOXSTRICTRC rcStrict;
3998	int rc;
3999
4000	/*
4001	* Try store it.
4002	* Unfortunately, CPUM only does a tiny bit of the work.
4003	*/
4004	switch (iCrReg)
4005	{
4006	case 0:
4007	{
4008	/*
4009	* Perform checks.
4010	*/
4011	uint64_t const uOldCrX = pCtx->cr0;
4012	uNewCrX \|= X86_CR0_ET; /* hardcoded */
4013
4014	/* Check for reserved bits. */
4015	uint32_t const fValid = X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS
4016	\| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_WP \| X86_CR0_AM
4017	\| X86_CR0_NW \| X86_CR0_CD \| X86_CR0_PG;
4018	if (uNewCrX & ~(uint64_t)fValid)
4019	{
4020	Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4021	return iemRaiseGeneralProtectionFault0(pIemCpu);
4022	}
4023
4024	/* Check for invalid combinations. */
4025	if ( (uNewCrX & X86_CR0_PG)
4026	&& !(uNewCrX & X86_CR0_PE) )
4027	{
4028	Log(("Trying to set CR0.PG without CR0.PE\n"));
4029	return iemRaiseGeneralProtectionFault0(pIemCpu);
4030	}
4031
4032	if ( !(uNewCrX & X86_CR0_CD)
4033	&& (uNewCrX & X86_CR0_NW) )
4034	{
4035	Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
4036	return iemRaiseGeneralProtectionFault0(pIemCpu);
4037	}
4038
4039	/* Long mode consistency checks. */
4040	if ( (uNewCrX & X86_CR0_PG)
4041	&& !(uOldCrX & X86_CR0_PG)
4042	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4043	{
4044	if (!(pCtx->cr4 & X86_CR4_PAE))
4045	{
4046	Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
4047	return iemRaiseGeneralProtectionFault0(pIemCpu);
4048	}
4049	if (pCtx->cs.Attr.n.u1Long)
4050	{
4051	Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
4052	return iemRaiseGeneralProtectionFault0(pIemCpu);
4053	}
4054	}
4055
4056	/** @todo check reserved PDPTR bits as AMD states. */
4057
4058	/*
4059	* Change CR0.
4060	*/
4061	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4062	CPUMSetGuestCR0(pVCpu, uNewCrX);
4063	else
4064	pCtx->cr0 = uNewCrX;
4065	Assert(pCtx->cr0 == uNewCrX);
4066
4067	/*
4068	* Change EFER.LMA if entering or leaving long mode.
4069	*/
4070	if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
4071	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4072	{
4073	uint64_t NewEFER = pCtx->msrEFER;
4074	if (uNewCrX & X86_CR0_PG)
4075	NewEFER \|= MSR_K6_EFER_LMA;
4076	else
4077	NewEFER &= ~MSR_K6_EFER_LMA;
4078
4079	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4080	CPUMSetGuestEFER(pVCpu, NewEFER);
4081	else
4082	pCtx->msrEFER = NewEFER;
4083	Assert(pCtx->msrEFER == NewEFER);
4084	}
4085
4086	/*
4087	* Inform PGM.
4088	*/
4089	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4090	{
4091	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
4092	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
4093	{
4094	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4095	AssertRCReturn(rc, rc);
4096	/* ignore informational status codes */
4097	}
4098	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4099	}
4100	else
4101	rcStrict = VINF_SUCCESS;
4102
4103	#ifdef IN_RC
4104	/* Return to ring-3 for rescheduling if WP or AM changes. */
4105	if ( rcStrict == VINF_SUCCESS
4106	&& ( (uNewCrX & (X86_CR0_WP \| X86_CR0_AM))
4107	!= (uOldCrX & (X86_CR0_WP \| X86_CR0_AM))) )
4108	rcStrict = VINF_EM_RESCHEDULE;
4109	#endif
4110	break;
4111	}
4112
4113	/*
4114	* CR2 can be changed without any restrictions.
4115	*/
4116	case 2:
4117	pCtx->cr2 = uNewCrX;
4118	rcStrict = VINF_SUCCESS;
4119	break;
4120
4121	/*
4122	* CR3 is relatively simple, although AMD and Intel have different
4123	* accounts of how setting reserved bits are handled. We take intel's
4124	* word for the lower bits and AMD's for the high bits (63:52).
4125	*/
4126	/** @todo Testcase: Setting reserved bits in CR3, especially before
4127	* enabling paging. */
4128	case 3:
4129	{
4130	/* check / mask the value. */
4131	if (uNewCrX & UINT64_C(0xfff0000000000000))
4132	{
4133	Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
4134	return iemRaiseGeneralProtectionFault0(pIemCpu);
4135	}
4136
4137	uint64_t fValid;
4138	if ( (pCtx->cr4 & X86_CR4_PAE)
4139	&& (pCtx->msrEFER & MSR_K6_EFER_LME))
4140	fValid = UINT64_C(0x000ffffffffff014);
4141	else if (pCtx->cr4 & X86_CR4_PAE)
4142	fValid = UINT64_C(0xfffffff4);
4143	else
4144	fValid = UINT64_C(0xfffff014);
4145	if (uNewCrX & ~fValid)
4146	{
4147	Log(("Automatically clearing reserved bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
4148	uNewCrX, uNewCrX & ~fValid));
4149	uNewCrX &= fValid;
4150	}
4151
4152	/** @todo If we're in PAE mode we should check the PDPTRs for
4153	* invalid bits. */
4154
4155	/* Make the change. */
4156	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4157	{
4158	rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
4159	AssertRCSuccessReturn(rc, rc);
4160	}
4161	else
4162	pCtx->cr3 = uNewCrX;
4163
4164	/* Inform PGM. */
4165	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4166	{
4167	if (pCtx->cr0 & X86_CR0_PG)
4168	{
4169	rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
4170	AssertRCReturn(rc, rc);
4171	/* ignore informational status codes */
4172	}
4173	}
4174	rcStrict = VINF_SUCCESS;
4175	break;
4176	}
4177
4178	/*
4179	* CR4 is a bit more tedious as there are bits which cannot be cleared
4180	* under some circumstances and such.
4181	*/
4182	case 4:
4183	{
4184	uint64_t const uOldCrX = pCtx->cr4;
4185
4186	/* reserved bits */
4187	uint32_t fValid = X86_CR4_VME \| X86_CR4_PVI
4188	\| X86_CR4_TSD \| X86_CR4_DE
4189	\| X86_CR4_PSE \| X86_CR4_PAE
4190	\| X86_CR4_MCE \| X86_CR4_PGE
4191	\| X86_CR4_PCE \| X86_CR4_OSFSXR
4192	\| X86_CR4_OSXMMEEXCPT;
4193	//if (xxx)
4194	// fValid \|= X86_CR4_VMXE;
4195	//if (xxx)
4196	// fValid \|= X86_CR4_OSXSAVE;
4197	if (uNewCrX & ~(uint64_t)fValid)
4198	{
4199	Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4200	return iemRaiseGeneralProtectionFault0(pIemCpu);
4201	}
4202
4203	/* long mode checks. */
4204	if ( (uOldCrX & X86_CR4_PAE)
4205	&& !(uNewCrX & X86_CR4_PAE)
4206	&& CPUMIsGuestInLongModeEx(pCtx) )
4207	{
4208	Log(("Trying to set clear CR4.PAE while long mode is active\n"));
4209	return iemRaiseGeneralProtectionFault0(pIemCpu);
4210	}
4211
4212
4213	/*
4214	* Change it.
4215	*/
4216	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4217	{
4218	rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
4219	AssertRCSuccessReturn(rc, rc);
4220	}
4221	else
4222	pCtx->cr4 = uNewCrX;
4223	Assert(pCtx->cr4 == uNewCrX);
4224
4225	/*
4226	* Notify SELM and PGM.
4227	*/
4228	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4229	{
4230	/* SELM - VME may change things wrt to the TSS shadowing. */
4231	if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
4232	{
4233	Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
4234	RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
4235	#ifdef VBOX_WITH_RAW_MODE
4236	if (!HMIsEnabled(IEMCPU_TO_VM(pIemCpu)))
4237	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
4238	#endif
4239	}
4240
4241	/* PGM - flushing and mode. */
4242	if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE \| X86_CR4_PAE \| X86_CR4_PGE))
4243	{
4244	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4245	AssertRCReturn(rc, rc);
4246	/* ignore informational status codes */
4247	}
4248	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4249	}
4250	else
4251	rcStrict = VINF_SUCCESS;
4252	break;
4253	}
4254
4255	/*
4256	* CR8 maps to the APIC TPR.
4257	*/
4258	case 8:
4259	if (uNewCrX & ~(uint64_t)0xf)
4260	{
4261	Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
4262	return iemRaiseGeneralProtectionFault0(pIemCpu);
4263	}
4264
4265	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4266	PDMApicSetTPR(IEMCPU_TO_VMCPU(pIemCpu), (uint8_t)uNewCrX << 4);
4267	rcStrict = VINF_SUCCESS;
4268	break;
4269
4270	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4271	}
4272
4273	/*
4274	* Advance the RIP on success.
4275	*/
4276	if (RT_SUCCESS(rcStrict))
4277	{
4278	if (rcStrict != VINF_SUCCESS)
4279	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4280	iemRegAddToRip(pIemCpu, cbInstr);
4281	}
4282
4283	return rcStrict;
4284	}
4285
4286
4287	/**
4288	* Implements mov CRx,GReg.
4289	*
4290	* @param iCrReg The CRx register to write (valid).
4291	* @param iGReg The general register to load the DRx value from.
4292	*/
4293	IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
4294	{
4295	if (pIemCpu->uCpl != 0)
4296	return iemRaiseGeneralProtectionFault0(pIemCpu);
4297	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4298
4299	/*
4300	* Read the new value from the source register and call common worker.
4301	*/
4302	uint64_t uNewCrX;
4303	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4304	uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
4305	else
4306	uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
4307	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
4308	}
4309
4310
4311	/**
4312	* Implements 'LMSW r/m16'
4313	*
4314	* @param u16NewMsw The new value.
4315	*/
4316	IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
4317	{
4318	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4319
4320	if (pIemCpu->uCpl != 0)
4321	return iemRaiseGeneralProtectionFault0(pIemCpu);
4322	Assert(!pCtx->eflags.Bits.u1VM);
4323
4324	/*
4325	* Compose the new CR0 value and call common worker.
4326	*/
4327	uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
4328	uNewCr0 \|= u16NewMsw & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
4329	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
4330	}
4331
4332
4333	/**
4334	* Implements 'CLTS'.
4335	*/
4336	IEM_CIMPL_DEF_0(iemCImpl_clts)
4337	{
4338	if (pIemCpu->uCpl != 0)
4339	return iemRaiseGeneralProtectionFault0(pIemCpu);
4340
4341	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4342	uint64_t uNewCr0 = pCtx->cr0;
4343	uNewCr0 &= ~X86_CR0_TS;
4344	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
4345	}
4346
4347
4348	/**
4349	* Implements mov GReg,DRx.
4350	*
4351	* @param iGReg The general register to store the DRx value in.
4352	* @param iDrReg The DRx register to read (0-7).
4353	*/
4354	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
4355	{
4356	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4357
4358	/*
4359	* Check preconditions.
4360	*/
4361
4362	/* Raise GPs. */
4363	if (pIemCpu->uCpl != 0)
4364	return iemRaiseGeneralProtectionFault0(pIemCpu);
4365	Assert(!pCtx->eflags.Bits.u1VM);
4366
4367	if ( (iDrReg == 4 \|\| iDrReg == 5)
4368	&& (pCtx->cr4 & X86_CR4_DE) )
4369	{
4370	Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
4371	return iemRaiseGeneralProtectionFault0(pIemCpu);
4372	}
4373
4374	/* Raise #DB if general access detect is enabled. */
4375	if (pCtx->dr[7] & X86_DR7_GD)
4376	{
4377	Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
4378	return iemRaiseDebugException(pIemCpu);
4379	}
4380
4381	/*
4382	* Read the debug register and store it in the specified general register.
4383	*/
4384	uint64_t drX;
4385	switch (iDrReg)
4386	{
4387	case 0: drX = pCtx->dr[0]; break;
4388	case 1: drX = pCtx->dr[1]; break;
4389	case 2: drX = pCtx->dr[2]; break;
4390	case 3: drX = pCtx->dr[3]; break;
4391	case 6:
4392	case 4:
4393	drX = pCtx->dr[6];
4394	drX \|= X86_DR6_RA1_MASK;
4395	drX &= ~X86_DR6_RAZ_MASK;
4396	break;
4397	case 7:
4398	case 5:
4399	drX = pCtx->dr[7];
4400	drX \|=X86_DR7_RA1_MASK;
4401	drX &= ~X86_DR7_RAZ_MASK;
4402	break;
4403	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4404	}
4405
4406	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4407	(uint64_t )iemGRegRef(pIemCpu, iGReg) = drX;
4408	else
4409	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
4410
4411	iemRegAddToRip(pIemCpu, cbInstr);
4412	return VINF_SUCCESS;
4413	}
4414
4415
4416	/**
4417	* Implements mov DRx,GReg.
4418	*
4419	* @param iDrReg The DRx register to write (valid).
4420	* @param iGReg The general register to load the DRx value from.
4421	*/
4422	IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
4423	{
4424	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4425
4426	/*
4427	* Check preconditions.
4428	*/
4429	if (pIemCpu->uCpl != 0)
4430	return iemRaiseGeneralProtectionFault0(pIemCpu);
4431	Assert(!pCtx->eflags.Bits.u1VM);
4432
4433	if (iDrReg == 4 \|\| iDrReg == 5)
4434	{
4435	if (pCtx->cr4 & X86_CR4_DE)
4436	{
4437	Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
4438	return iemRaiseGeneralProtectionFault0(pIemCpu);
4439	}
4440	iDrReg += 2;
4441	}
4442
4443	/* Raise #DB if general access detect is enabled. */
4444	/** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
4445	* \#GP? */
4446	if (pCtx->dr[7] & X86_DR7_GD)
4447	{
4448	Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
4449	return iemRaiseDebugException(pIemCpu);
4450	}
4451
4452	/*
4453	* Read the new value from the source register.
4454	*/
4455	uint64_t uNewDrX;
4456	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4457	uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
4458	else
4459	uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
4460
4461	/*
4462	* Adjust it.
4463	*/
4464	switch (iDrReg)
4465	{
4466	case 0:
4467	case 1:
4468	case 2:
4469	case 3:
4470	/* nothing to adjust */
4471	break;
4472
4473	case 6:
4474	if (uNewDrX & X86_DR6_MBZ_MASK)
4475	{
4476	Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
4477	return iemRaiseGeneralProtectionFault0(pIemCpu);
4478	}
4479	uNewDrX \|= X86_DR6_RA1_MASK;
4480	uNewDrX &= ~X86_DR6_RAZ_MASK;
4481	break;
4482
4483	case 7:
4484	if (uNewDrX & X86_DR7_MBZ_MASK)
4485	{
4486	Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
4487	return iemRaiseGeneralProtectionFault0(pIemCpu);
4488	}
4489	uNewDrX \|= X86_DR7_RA1_MASK;
4490	uNewDrX &= ~X86_DR7_RAZ_MASK;
4491	break;
4492
4493	IEM_NOT_REACHED_DEFAULT_CASE_RET();
4494	}
4495
4496	/*
4497	* Do the actual setting.
4498	*/
4499	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4500	{
4501	int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
4502	AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_INTERNAL_ERROR : rc);
4503	}
4504	else
4505	pCtx->dr[iDrReg] = uNewDrX;
4506
4507	iemRegAddToRip(pIemCpu, cbInstr);
4508	return VINF_SUCCESS;
4509	}
4510
4511
4512	/**
4513	* Implements 'INVLPG m'.
4514	*
4515	* @param GCPtrPage The effective address of the page to invalidate.
4516	* @remarks Updates the RIP.
4517	*/
4518	IEM_CIMPL_DEF_1(iemCImpl_invlpg, uint8_t, GCPtrPage)
4519	{
4520	/* ring-0 only. */
4521	if (pIemCpu->uCpl != 0)
4522	return iemRaiseGeneralProtectionFault0(pIemCpu);
4523	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4524
4525	int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
4526	iemRegAddToRip(pIemCpu, cbInstr);
4527
4528	if (rc == VINF_SUCCESS)
4529	return VINF_SUCCESS;
4530	if (rc == VINF_PGM_SYNC_CR3)
4531	return iemSetPassUpStatus(pIemCpu, rc);
4532
4533	AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR \|\| RT_FAILURE_NP(rc), ("%Rrc\n", rc));
4534	Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", rc));
4535	return rc;
4536	}
4537
4538
4539	/**
4540	* Implements RDTSC.
4541	*/
4542	IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
4543	{
4544	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4545
4546	/*
4547	* Check preconditions.
4548	*/
4549	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_TSC))
4550	return iemRaiseUndefinedOpcode(pIemCpu);
4551
4552	if ( (pCtx->cr4 & X86_CR4_TSD)
4553	&& pIemCpu->uCpl != 0)
4554	{
4555	Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
4556	return iemRaiseGeneralProtectionFault0(pIemCpu);
4557	}
4558
4559	/*
4560	* Do the job.
4561	*/
4562	uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
4563	pCtx->rax = (uint32_t)uTicks;
4564	pCtx->rdx = uTicks >> 32;
4565	#ifdef IEM_VERIFICATION_MODE_FULL
4566	pIemCpu->fIgnoreRaxRdx = true;
4567	#endif
4568
4569	iemRegAddToRip(pIemCpu, cbInstr);
4570	return VINF_SUCCESS;
4571	}
4572
4573
4574	/**
4575	* Implements RDMSR.
4576	*/
4577	IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
4578	{
4579	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4580
4581	/*
4582	* Check preconditions.
4583	*/
4584	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
4585	return iemRaiseUndefinedOpcode(pIemCpu);
4586	if (pIemCpu->uCpl != 0)
4587	return iemRaiseGeneralProtectionFault0(pIemCpu);
4588
4589	/*
4590	* Do the job.
4591	*/
4592	RTUINT64U uValue;
4593	int rc = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
4594	if (rc != VINF_SUCCESS)
4595	{
4596	Log(("IEM: rdmsr(%#x) -> GP(0)\n", pCtx->ecx));
4597	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
4598	return iemRaiseGeneralProtectionFault0(pIemCpu);
4599	}
4600
4601	pCtx->rax = uValue.s.Lo;
4602	pCtx->rdx = uValue.s.Hi;
4603
4604	iemRegAddToRip(pIemCpu, cbInstr);
4605	return VINF_SUCCESS;
4606	}
4607
4608
4609	/**
4610	* Implements WRMSR.
4611	*/
4612	IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
4613	{
4614	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4615
4616	/*
4617	* Check preconditions.
4618	*/
4619	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
4620	return iemRaiseUndefinedOpcode(pIemCpu);
4621	if (pIemCpu->uCpl != 0)
4622	return iemRaiseGeneralProtectionFault0(pIemCpu);
4623
4624	/*
4625	* Do the job.
4626	*/
4627	RTUINT64U uValue;
4628	uValue.s.Lo = pCtx->eax;
4629	uValue.s.Hi = pCtx->edx;
4630
4631	int rc;
4632	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4633	rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
4634	else
4635	{
4636	CPUMCTX CtxTmp = *pCtx;
4637	rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
4638	PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(IEMCPU_TO_VMCPU(pIemCpu));
4639	pCtx = pCtx2;
4640	*pCtx2 = CtxTmp;
4641	}
4642	if (rc != VINF_SUCCESS)
4643	{
4644	Log(("IEM: wrmsr(%#x,%#x`%08x) -> GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
4645	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
4646	return iemRaiseGeneralProtectionFault0(pIemCpu);
4647	}
4648
4649	iemRegAddToRip(pIemCpu, cbInstr);
4650	return VINF_SUCCESS;
4651	}
4652
4653
4654	/**
4655	* Implements 'IN eAX, port'.
4656	*
4657	* @param u16Port The source port.
4658	* @param cbReg The register size.
4659	*/
4660	IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
4661	{
4662	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4663
4664	/*
4665	* CPL check
4666	*/
4667	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
4668	if (rcStrict != VINF_SUCCESS)
4669	return rcStrict;
4670
4671	/*
4672	* Perform the I/O.
4673	*/
4674	uint32_t u32Value;
4675	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4676	rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, &u32Value, cbReg);
4677	else
4678	rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
4679	if (IOM_SUCCESS(rcStrict))
4680	{
4681	switch (cbReg)
4682	{
4683	case 1: pCtx->al = (uint8_t)u32Value; break;
4684	case 2: pCtx->ax = (uint16_t)u32Value; break;
4685	case 4: pCtx->rax = u32Value; break;
4686	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
4687	}
4688	iemRegAddToRip(pIemCpu, cbInstr);
4689	pIemCpu->cPotentialExits++;
4690	if (rcStrict != VINF_SUCCESS)
4691	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4692	}
4693
4694	return rcStrict;
4695	}
4696
4697
4698	/**
4699	* Implements 'IN eAX, DX'.
4700	*
4701	* @param cbReg The register size.
4702	*/
4703	IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
4704	{
4705	return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
4706	}
4707
4708
4709	/**
4710	* Implements 'OUT port, eAX'.
4711	*
4712	* @param u16Port The destination port.
4713	* @param cbReg The register size.
4714	*/
4715	IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
4716	{
4717	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4718
4719	/*
4720	* CPL check
4721	*/
4722	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
4723	if (rcStrict != VINF_SUCCESS)
4724	return rcStrict;
4725
4726	/*
4727	* Perform the I/O.
4728	*/
4729	uint32_t u32Value;
4730	switch (cbReg)
4731	{
4732	case 1: u32Value = pCtx->al; break;
4733	case 2: u32Value = pCtx->ax; break;
4734	case 4: u32Value = pCtx->eax; break;
4735	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
4736	}
4737	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4738	rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, u32Value, cbReg);
4739	else
4740	rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
4741	if (IOM_SUCCESS(rcStrict))
4742	{
4743	iemRegAddToRip(pIemCpu, cbInstr);
4744	pIemCpu->cPotentialExits++;
4745	if (rcStrict != VINF_SUCCESS)
4746	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4747	}
4748	return rcStrict;
4749	}
4750
4751
4752	/**
4753	* Implements 'OUT DX, eAX'.
4754	*
4755	* @param cbReg The register size.
4756	*/
4757	IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
4758	{
4759	return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
4760	}
4761
4762
4763	/**
4764	* Implements 'CLI'.
4765	*/
4766	IEM_CIMPL_DEF_0(iemCImpl_cli)
4767	{
4768	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4769	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4770	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
4771	uint32_t const fEflOld = fEfl;
4772	if (pCtx->cr0 & X86_CR0_PE)
4773	{
4774	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
4775	if (!(fEfl & X86_EFL_VM))
4776	{
4777	if (pIemCpu->uCpl <= uIopl)
4778	fEfl &= ~X86_EFL_IF;
4779	else if ( pIemCpu->uCpl == 3
4780	&& (pCtx->cr4 & X86_CR4_PVI) )
4781	fEfl &= ~X86_EFL_VIF;
4782	else
4783	return iemRaiseGeneralProtectionFault0(pIemCpu);
4784	}
4785	/* V8086 */
4786	else if (uIopl == 3)
4787	fEfl &= ~X86_EFL_IF;
4788	else if ( uIopl < 3
4789	&& (pCtx->cr4 & X86_CR4_VME) )
4790	fEfl &= ~X86_EFL_VIF;
4791	else
4792	return iemRaiseGeneralProtectionFault0(pIemCpu);
4793	}
4794	/* real mode */
4795	else
4796	fEfl &= ~X86_EFL_IF;
4797
4798	/* Commit. */
4799	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4800	iemRegAddToRip(pIemCpu, cbInstr);
4801	Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
4802	return VINF_SUCCESS;
4803	}
4804
4805
4806	/**
4807	* Implements 'STI'.
4808	*/
4809	IEM_CIMPL_DEF_0(iemCImpl_sti)
4810	{
4811	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4812	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4813	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
4814	uint32_t const fEflOld = fEfl;
4815
4816	if (pCtx->cr0 & X86_CR0_PE)
4817	{
4818	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
4819	if (!(fEfl & X86_EFL_VM))
4820	{
4821	if (pIemCpu->uCpl <= uIopl)
4822	fEfl \|= X86_EFL_IF;
4823	else if ( pIemCpu->uCpl == 3
4824	&& (pCtx->cr4 & X86_CR4_PVI)
4825	&& !(fEfl & X86_EFL_VIP) )
4826	fEfl \|= X86_EFL_VIF;
4827	else
4828	return iemRaiseGeneralProtectionFault0(pIemCpu);
4829	}
4830	/* V8086 */
4831	else if (uIopl == 3)
4832	fEfl \|= X86_EFL_IF;
4833	else if ( uIopl < 3
4834	&& (pCtx->cr4 & X86_CR4_VME)
4835	&& !(fEfl & X86_EFL_VIP) )
4836	fEfl \|= X86_EFL_VIF;
4837	else
4838	return iemRaiseGeneralProtectionFault0(pIemCpu);
4839	}
4840	/* real mode */
4841	else
4842	fEfl \|= X86_EFL_IF;
4843
4844	/* Commit. */
4845	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4846	iemRegAddToRip(pIemCpu, cbInstr);
4847	if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) \|\| IEM_VERIFICATION_ENABLED(pIemCpu))
4848	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4849	Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
4850	return VINF_SUCCESS;
4851	}
4852
4853
4854	/**
4855	* Implements 'HLT'.
4856	*/
4857	IEM_CIMPL_DEF_0(iemCImpl_hlt)
4858	{
4859	if (pIemCpu->uCpl != 0)
4860	return iemRaiseGeneralProtectionFault0(pIemCpu);
4861	iemRegAddToRip(pIemCpu, cbInstr);
4862	return VINF_EM_HALT;
4863	}
4864
4865
4866	/**
4867	* Implements 'MONITOR'.
4868	*/
4869	IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
4870	{
4871	/*
4872	* Permission checks.
4873	*/
4874	if (pIemCpu->uCpl != 0)
4875	{
4876	Log2(("monitor: CPL != 0\n"));
4877	return iemRaiseUndefinedOpcode(pIemCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
4878	}
4879	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_ECX(X86_CPUID_FEATURE_ECX_MONITOR))
4880	{
4881	Log2(("monitor: Not in CPUID\n"));
4882	return iemRaiseUndefinedOpcode(pIemCpu);
4883	}
4884
4885	/*
4886	* Gather the operands and validate them.
4887	*/
4888	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4889	RTGCPTR GCPtrMem = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
4890	uint32_t uEcx = pCtx->ecx;
4891	uint32_t uEdx = pCtx->edx;
4892	/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
4893	* \#GP first. */
4894	if (uEcx != 0)
4895	{
4896	Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx));
4897	return iemRaiseGeneralProtectionFault0(pIemCpu);
4898	}
4899
4900	VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
4901	if (rcStrict != VINF_SUCCESS)
4902	return rcStrict;
4903
4904	RTGCPHYS GCPhysMem;
4905	rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, &GCPhysMem);
4906	if (rcStrict != VINF_SUCCESS)
4907	return rcStrict;
4908
4909	/*
4910	* Call EM to prepare the monitor/wait.
4911	*/
4912	rcStrict = EMMonitorWaitPrepare(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
4913	Assert(rcStrict == VINF_SUCCESS);
4914
4915	iemRegAddToRip(pIemCpu, cbInstr);
4916	return rcStrict;
4917	}
4918
4919
4920	/**
4921	* Implements 'MWAIT'.
4922	*/
4923	IEM_CIMPL_DEF_0(iemCImpl_mwait)
4924	{
4925	/*
4926	* Permission checks.
4927	*/
4928	if (pIemCpu->uCpl != 0)
4929	{
4930	Log2(("mwait: CPL != 0\n"));
4931	/** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
4932	* EFLAGS.VM then.) */
4933	return iemRaiseUndefinedOpcode(pIemCpu);
4934	}
4935	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_ECX(X86_CPUID_FEATURE_ECX_MONITOR))
4936	{
4937	Log2(("mwait: Not in CPUID\n"));
4938	return iemRaiseUndefinedOpcode(pIemCpu);
4939	}
4940
4941	/*
4942	* Gather the operands and validate them.
4943	*/
4944	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4945	uint32_t uEax = pCtx->eax;
4946	uint32_t uEcx = pCtx->ecx;
4947	if (uEcx != 0)
4948	{
4949	/* Only supported extension is break on IRQ when IF=0. */
4950	if (uEcx > 1)
4951	{
4952	Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
4953	return iemRaiseGeneralProtectionFault0(pIemCpu);
4954	}
4955	uint32_t fMWaitFeatures = 0;
4956	uint32_t uIgnore = 0;
4957	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), 5, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
4958	if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
4959	!= (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
4960	{
4961	Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
4962	return iemRaiseGeneralProtectionFault0(pIemCpu);
4963	}
4964	}
4965
4966	/*
4967	* Call EM to prepare the monitor/wait.
4968	*/
4969	VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(IEMCPU_TO_VMCPU(pIemCpu), uEax, uEcx);
4970
4971	iemRegAddToRip(pIemCpu, cbInstr);
4972	return rcStrict;
4973	}
4974
4975
4976	/**
4977	* Implements 'SWAPGS'.
4978	*/
4979	IEM_CIMPL_DEF_0(iemCImpl_swapgs)
4980	{
4981	Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
4982
4983	/*
4984	* Permission checks.
4985	*/
4986	if (pIemCpu->uCpl != 0)
4987	{
4988	Log2(("swapgs: CPL != 0\n"));
4989	return iemRaiseUndefinedOpcode(pIemCpu);
4990	}
4991
4992	/*
4993	* Do the job.
4994	*/
4995	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4996	uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
4997	pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
4998	pCtx->gs.u64Base = uOtherGsBase;
4999
5000	iemRegAddToRip(pIemCpu, cbInstr);
5001	return VINF_SUCCESS;
5002	}
5003
5004
5005	/**
5006	* Implements 'CPUID'.
5007	*/
5008	IEM_CIMPL_DEF_0(iemCImpl_cpuid)
5009	{
5010	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5011
5012	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
5013	pCtx->rax &= UINT32_C(0xffffffff);
5014	pCtx->rbx &= UINT32_C(0xffffffff);
5015	pCtx->rcx &= UINT32_C(0xffffffff);
5016	pCtx->rdx &= UINT32_C(0xffffffff);
5017
5018	iemRegAddToRip(pIemCpu, cbInstr);
5019	return VINF_SUCCESS;
5020	}
5021
5022
5023	/**
5024	* Implements 'AAD'.
5025	*
5026	* @param enmEffOpSize The effective operand size.
5027	*/
5028	IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
5029	{
5030	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5031
5032	uint16_t const ax = pCtx->ax;
5033	uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
5034	pCtx->ax = al;
5035	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5036	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
5037	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
5038
5039	iemRegAddToRip(pIemCpu, cbInstr);
5040	return VINF_SUCCESS;
5041	}
5042
5043
5044	/**
5045	* Implements 'AAM'.
5046	*
5047	* @param bImm The immediate operand. Cannot be 0.
5048	*/
5049	IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
5050	{
5051	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5052	Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
5053
5054	uint16_t const ax = pCtx->ax;
5055	uint8_t const al = (uint8_t)ax % bImm;
5056	uint8_t const ah = (uint8_t)ax / bImm;
5057	pCtx->ax = (ah << 8) + al;
5058	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5059	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
5060	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
5061
5062	iemRegAddToRip(pIemCpu, cbInstr);
5063	return VINF_SUCCESS;
5064	}
5065
5066
5067
5068
5069	/*
5070	* Instantiate the various string operation combinations.
5071	*/
5072	#define OP_SIZE 8
5073	#define ADDR_SIZE 16
5074	#include "IEMAllCImplStrInstr.cpp.h"
5075	#define OP_SIZE 8
5076	#define ADDR_SIZE 32
5077	#include "IEMAllCImplStrInstr.cpp.h"
5078	#define OP_SIZE 8
5079	#define ADDR_SIZE 64
5080	#include "IEMAllCImplStrInstr.cpp.h"
5081
5082	#define OP_SIZE 16
5083	#define ADDR_SIZE 16
5084	#include "IEMAllCImplStrInstr.cpp.h"
5085	#define OP_SIZE 16
5086	#define ADDR_SIZE 32
5087	#include "IEMAllCImplStrInstr.cpp.h"
5088	#define OP_SIZE 16
5089	#define ADDR_SIZE 64
5090	#include "IEMAllCImplStrInstr.cpp.h"
5091
5092	#define OP_SIZE 32
5093	#define ADDR_SIZE 16
5094	#include "IEMAllCImplStrInstr.cpp.h"
5095	#define OP_SIZE 32
5096	#define ADDR_SIZE 32
5097	#include "IEMAllCImplStrInstr.cpp.h"
5098	#define OP_SIZE 32
5099	#define ADDR_SIZE 64
5100	#include "IEMAllCImplStrInstr.cpp.h"
5101
5102	#define OP_SIZE 64
5103	#define ADDR_SIZE 32
5104	#include "IEMAllCImplStrInstr.cpp.h"
5105	#define OP_SIZE 64
5106	#define ADDR_SIZE 64
5107	#include "IEMAllCImplStrInstr.cpp.h"
5108
5109
5110	/**
5111	* Implements 'FINIT' and 'FNINIT'.
5112	*
5113	* @param fCheckXcpts Whether to check for umasked pending exceptions or
5114	* not.
5115	*/
5116	IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
5117	{
5118	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5119
5120	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
5121	return iemRaiseDeviceNotAvailable(pIemCpu);
5122
5123	NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
5124	if (fCheckXcpts && TODO )
5125	return iemRaiseMathFault(pIemCpu);
5126	*/
5127
5128	if (iemFRegIsFxSaveFormat(pIemCpu))
5129	{
5130	pCtx->fpu.FCW = 0x37f;
5131	pCtx->fpu.FSW = 0;
5132	pCtx->fpu.FTW = 0x00; /* 0 - empty. */
5133	pCtx->fpu.FPUDP = 0;
5134	pCtx->fpu.DS = 0; //??
5135	pCtx->fpu.Rsrvd2= 0;
5136	pCtx->fpu.FPUIP = 0;
5137	pCtx->fpu.CS = 0; //??
5138	pCtx->fpu.Rsrvd1= 0;
5139	pCtx->fpu.FOP = 0;
5140	}
5141	else
5142	{
5143	PX86FPUSTATE pFpu = (PX86FPUSTATE)&pCtx->fpu;
5144	pFpu->FCW = 0x37f;
5145	pFpu->FSW = 0;
5146	pFpu->FTW = 0xffff; /* 11 - empty */
5147	pFpu->FPUOO = 0; //??
5148	pFpu->FPUOS = 0; //??
5149	pFpu->FPUIP = 0;
5150	pFpu->CS = 0; //??
5151	pFpu->FOP = 0;
5152	}
5153
5154	iemHlpUsedFpu(pIemCpu);
5155	iemRegAddToRip(pIemCpu, cbInstr);
5156	return VINF_SUCCESS;
5157	}
5158
5159
5160	/**
5161	* Implements 'FXSAVE'.
5162	*
5163	* @param iEffSeg The effective segment.
5164	* @param GCPtrEff The address of the image.
5165	* @param enmEffOpSize The operand size (only REX.W really matters).
5166	*/
5167	IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
5168	{
5169	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5170
5171	/*
5172	* Raise exceptions.
5173	*/
5174	if (pCtx->cr0 & X86_CR0_EM)
5175	return iemRaiseUndefinedOpcode(pIemCpu);
5176	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
5177	return iemRaiseDeviceNotAvailable(pIemCpu);
5178	if (GCPtrEff & 15)
5179	{
5180	/** @todo CPU/VM detection possible! \#AC might not be signal for
5181	* all/any misalignment sizes, intel says its an implementation detail. */
5182	if ( (pCtx->cr0 & X86_CR0_AM)
5183	&& pCtx->eflags.Bits.u1AC
5184	&& pIemCpu->uCpl == 3)
5185	return iemRaiseAlignmentCheckException(pIemCpu);
5186	return iemRaiseGeneralProtectionFault0(pIemCpu);
5187	}
5188	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
5189
5190	/*
5191	* Access the memory.
5192	*/
5193	void *pvMem512;
5194	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5195	if (rcStrict != VINF_SUCCESS)
5196	return rcStrict;
5197	PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
5198
5199	/*
5200	* Store the registers.
5201	*/
5202	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
5203	* implementation specific whether MXCSR and XMM0-XMM7 are saved. */
5204
5205	/* common for all formats */
5206	pDst->FCW = pCtx->fpu.FCW;
5207	pDst->FSW = pCtx->fpu.FSW;
5208	pDst->FTW = pCtx->fpu.FTW & UINT16_C(0xff);
5209	pDst->FOP = pCtx->fpu.FOP;
5210	pDst->MXCSR = pCtx->fpu.MXCSR;
5211	pDst->MXCSR_MASK = pCtx->fpu.MXCSR_MASK;
5212	for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
5213	{
5214	/** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
5215	* them for now... */
5216	pDst->aRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
5217	pDst->aRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
5218	pDst->aRegs[i].au32[2] = pCtx->fpu.aRegs[i].au32[2] & UINT32_C(0xffff);
5219	pDst->aRegs[i].au32[3] = 0;
5220	}
5221
5222	/* FPU IP, CS, DP and DS. */
5223	/** @todo FPU IP, CS, DP and DS cannot be implemented correctly without extra
5224	* state information. :-/
5225	* Storing zeros now to prevent any potential leakage of host info. */
5226	pDst->FPUIP = 0;
5227	pDst->CS = 0;
5228	pDst->Rsrvd1 = 0;
5229	pDst->FPUDP = 0;
5230	pDst->DS = 0;
5231	pDst->Rsrvd2 = 0;
5232
5233	/* XMM registers. */
5234	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
5235	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
5236	\|\| pIemCpu->uCpl != 0)
5237	{
5238	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
5239	for (uint32_t i = 0; i < cXmmRegs; i++)
5240	pDst->aXMM[i] = pCtx->fpu.aXMM[i];
5241	/** @todo Testcase: What happens to the reserved XMM registers? Untouched,
5242	* right? */
5243	}
5244
5245	/*
5246	* Commit the memory.
5247	*/
5248	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5249	if (rcStrict != VINF_SUCCESS)
5250	return rcStrict;
5251
5252	iemRegAddToRip(pIemCpu, cbInstr);
5253	return VINF_SUCCESS;
5254	}
5255
5256
5257	/**
5258	* Implements 'FXRSTOR'.
5259	*
5260	* @param GCPtrEff The address of the image.
5261	* @param enmEffOpSize The operand size (only REX.W really matters).
5262	*/
5263	IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
5264	{
5265	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5266
5267	/*
5268	* Raise exceptions.
5269	*/
5270	if (pCtx->cr0 & X86_CR0_EM)
5271	return iemRaiseUndefinedOpcode(pIemCpu);
5272	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
5273	return iemRaiseDeviceNotAvailable(pIemCpu);
5274	if (GCPtrEff & 15)
5275	{
5276	/** @todo CPU/VM detection possible! \#AC might not be signal for
5277	* all/any misalignment sizes, intel says its an implementation detail. */
5278	if ( (pCtx->cr0 & X86_CR0_AM)
5279	&& pCtx->eflags.Bits.u1AC
5280	&& pIemCpu->uCpl == 3)
5281	return iemRaiseAlignmentCheckException(pIemCpu);
5282	return iemRaiseGeneralProtectionFault0(pIemCpu);
5283	}
5284	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
5285
5286	/*
5287	* Access the memory.
5288	*/
5289	void *pvMem512;
5290	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
5291	if (rcStrict != VINF_SUCCESS)
5292	return rcStrict;
5293	PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
5294
5295	/*
5296	* Check the state for stuff which will GP(0).
5297	*/
5298	uint32_t const fMXCSR = pSrc->MXCSR;
5299	uint32_t const fMXCSR_MASK = pCtx->fpu.MXCSR_MASK ? pCtx->fpu.MXCSR_MASK : UINT32_C(0xffbf);
5300	if (fMXCSR & ~fMXCSR_MASK)
5301	{
5302	Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
5303	return iemRaiseGeneralProtectionFault0(pIemCpu);
5304	}
5305
5306	/*
5307	* Load the registers.
5308	*/
5309	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
5310	* implementation specific whether MXCSR and XMM0-XMM7 are restored. */
5311
5312	/* common for all formats */
5313	pCtx->fpu.FCW = pSrc->FCW;
5314	pCtx->fpu.FSW = pSrc->FSW;
5315	pCtx->fpu.FTW = pSrc->FTW & UINT16_C(0xff);
5316	pCtx->fpu.FOP = pSrc->FOP;
5317	pCtx->fpu.MXCSR = fMXCSR;
5318	/* (MXCSR_MASK is read-only) */
5319	for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
5320	{
5321	pCtx->fpu.aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
5322	pCtx->fpu.aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
5323	pCtx->fpu.aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
5324	pCtx->fpu.aRegs[i].au32[3] = 0;
5325	}
5326
5327	/* FPU IP, CS, DP and DS. */
5328	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5329	{
5330	pCtx->fpu.FPUIP = pSrc->FPUIP;
5331	pCtx->fpu.CS = pSrc->CS;
5332	pCtx->fpu.Rsrvd1 = pSrc->Rsrvd1;
5333	pCtx->fpu.FPUDP = pSrc->FPUDP;
5334	pCtx->fpu.DS = pSrc->DS;
5335	pCtx->fpu.Rsrvd2 = pSrc->Rsrvd2;
5336	}
5337	else
5338	{
5339	pCtx->fpu.FPUIP = pSrc->FPUIP;
5340	pCtx->fpu.CS = pSrc->CS;
5341	pCtx->fpu.Rsrvd1 = 0;
5342	pCtx->fpu.FPUDP = pSrc->FPUDP;
5343	pCtx->fpu.DS = pSrc->DS;
5344	pCtx->fpu.Rsrvd2 = 0;
5345	}
5346
5347	/* XMM registers. */
5348	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
5349	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
5350	\|\| pIemCpu->uCpl != 0)
5351	{
5352	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
5353	for (uint32_t i = 0; i < cXmmRegs; i++)
5354	pCtx->fpu.aXMM[i] = pSrc->aXMM[i];
5355	}
5356
5357	/*
5358	* Commit the memory.
5359	*/
5360	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
5361	if (rcStrict != VINF_SUCCESS)
5362	return rcStrict;
5363
5364	iemHlpUsedFpu(pIemCpu);
5365	iemRegAddToRip(pIemCpu, cbInstr);
5366	return VINF_SUCCESS;
5367	}
5368
5369
5370	/**
5371	* Commmon routine for fnstenv and fnsave.
5372	*
5373	* @param uPtr Where to store the state.
5374	* @param pCtx The CPU context.
5375	*/
5376	static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
5377	{
5378	if (enmEffOpSize == IEMMODE_16BIT)
5379	{
5380	uPtr.pu16[0] = pCtx->fpu.FCW;
5381	uPtr.pu16[1] = pCtx->fpu.FSW;
5382	uPtr.pu16[2] = iemFpuCalcFullFtw(pCtx);
5383	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5384	{
5385	/** @todo Testcase: How does this work when the FPUIP/CS was saved in
5386	* protected mode or long mode and we save it in real mode? And vice
5387	* versa? And with 32-bit operand size? I think CPU is storing the
5388	* effective address ((CS << 4) + IP) in the offset register and not
5389	* doing any address calculations here. */
5390	uPtr.pu16[3] = (uint16_t)pCtx->fpu.FPUIP;
5391	uPtr.pu16[4] = ((pCtx->fpu.FPUIP >> 4) & UINT16_C(0xf000)) \| pCtx->fpu.FOP;
5392	uPtr.pu16[5] = (uint16_t)pCtx->fpu.FPUDP;
5393	uPtr.pu16[6] = (pCtx->fpu.FPUDP >> 4) & UINT16_C(0xf000);
5394	}
5395	else
5396	{
5397	uPtr.pu16[3] = pCtx->fpu.FPUIP;
5398	uPtr.pu16[4] = pCtx->fpu.CS;
5399	uPtr.pu16[5] = pCtx->fpu.FPUDP;
5400	uPtr.pu16[6] = pCtx->fpu.DS;
5401	}
5402	}
5403	else
5404	{
5405	/** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
5406	uPtr.pu16[0*2] = pCtx->fpu.FCW;
5407	uPtr.pu16[1*2] = pCtx->fpu.FSW;
5408	uPtr.pu16[2*2] = iemFpuCalcFullFtw(pCtx);
5409	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5410	{
5411	uPtr.pu16[3*2] = (uint16_t)pCtx->fpu.FPUIP;
5412	uPtr.pu32[4] = ((pCtx->fpu.FPUIP & UINT32_C(0xffff0000)) >> 4) \| pCtx->fpu.FOP;
5413	uPtr.pu16[5*2] = (uint16_t)pCtx->fpu.FPUDP;
5414	uPtr.pu32[6] = (pCtx->fpu.FPUDP & UINT32_C(0xffff0000)) >> 4;
5415	}
5416	else
5417	{
5418	uPtr.pu32[3] = pCtx->fpu.FPUIP;
5419	uPtr.pu16[4*2] = pCtx->fpu.CS;
5420	uPtr.pu16[4*2+1]= pCtx->fpu.FOP;
5421	uPtr.pu32[5] = pCtx->fpu.FPUDP;
5422	uPtr.pu16[6*2] = pCtx->fpu.DS;
5423	}
5424	}
5425	}
5426
5427
5428	/**
5429	* Commmon routine for fldenv and frstor
5430	*
5431	* @param uPtr Where to store the state.
5432	* @param pCtx The CPU context.
5433	*/
5434	static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
5435	{
5436	if (enmEffOpSize == IEMMODE_16BIT)
5437	{
5438	pCtx->fpu.FCW = uPtr.pu16[0];
5439	pCtx->fpu.FSW = uPtr.pu16[1];
5440	pCtx->fpu.FTW = uPtr.pu16[2];
5441	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5442	{
5443	pCtx->fpu.FPUIP = uPtr.pu16[3] \| ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
5444	pCtx->fpu.FPUDP = uPtr.pu16[5] \| ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
5445	pCtx->fpu.FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
5446	pCtx->fpu.CS = 0;
5447	pCtx->fpu.Rsrvd1= 0;
5448	pCtx->fpu.DS = 0;
5449	pCtx->fpu.Rsrvd2= 0;
5450	}
5451	else
5452	{
5453	pCtx->fpu.FPUIP = uPtr.pu16[3];
5454	pCtx->fpu.CS = uPtr.pu16[4];
5455	pCtx->fpu.Rsrvd1= 0;
5456	pCtx->fpu.FPUDP = uPtr.pu16[5];
5457	pCtx->fpu.DS = uPtr.pu16[6];
5458	pCtx->fpu.Rsrvd2= 0;
5459	/** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
5460	}
5461	}
5462	else
5463	{
5464	pCtx->fpu.FCW = uPtr.pu16[0*2];
5465	pCtx->fpu.FSW = uPtr.pu16[1*2];
5466	pCtx->fpu.FTW = uPtr.pu16[2*2];
5467	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5468	{
5469	pCtx->fpu.FPUIP = uPtr.pu16[3*2] \| ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
5470	pCtx->fpu.FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
5471	pCtx->fpu.FPUDP = uPtr.pu16[5*2] \| ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
5472	pCtx->fpu.CS = 0;
5473	pCtx->fpu.Rsrvd1= 0;
5474	pCtx->fpu.DS = 0;
5475	pCtx->fpu.Rsrvd2= 0;
5476	}
5477	else
5478	{
5479	pCtx->fpu.FPUIP = uPtr.pu32[3];
5480	pCtx->fpu.CS = uPtr.pu16[4*2];
5481	pCtx->fpu.Rsrvd1= 0;
5482	pCtx->fpu.FOP = uPtr.pu16[4*2+1];
5483	pCtx->fpu.FPUDP = uPtr.pu32[5];
5484	pCtx->fpu.DS = uPtr.pu16[6*2];
5485	pCtx->fpu.Rsrvd2= 0;
5486	}
5487	}
5488
5489	/* Make adjustments. */
5490	pCtx->fpu.FTW = iemFpuCompressFtw(pCtx->fpu.FTW);
5491	pCtx->fpu.FCW &= ~X86_FCW_ZERO_MASK;
5492	iemFpuRecalcExceptionStatus(pCtx);
5493	/** @todo Testcase: Check if ES and/or B are automatically cleared if no
5494	* exceptions are pending after loading the saved state? */
5495	}
5496
5497
5498	/**
5499	* Implements 'FNSTENV'.
5500	*
5501	* @param enmEffOpSize The operand size (only REX.W really matters).
5502	* @param iEffSeg The effective segment register for @a GCPtrEff.
5503	* @param GCPtrEffDst The address of the image.
5504	*/
5505	IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5506	{
5507	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5508	RTPTRUNION uPtr;
5509	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
5510	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5511	if (rcStrict != VINF_SUCCESS)
5512	return rcStrict;
5513
5514	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5515
5516	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5517	if (rcStrict != VINF_SUCCESS)
5518	return rcStrict;
5519
5520	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
5521	iemRegAddToRip(pIemCpu, cbInstr);
5522	return VINF_SUCCESS;
5523	}
5524
5525
5526	/**
5527	* Implements 'FNSAVE'.
5528	*
5529	* @param GCPtrEffDst The address of the image.
5530	* @param enmEffOpSize The operand size.
5531	*/
5532	IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5533	{
5534	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5535	RTPTRUNION uPtr;
5536	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
5537	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5538	if (rcStrict != VINF_SUCCESS)
5539	return rcStrict;
5540
5541	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5542	PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
5543	for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
5544	{
5545	paRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
5546	paRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
5547	paRegs[i].au16[4] = pCtx->fpu.aRegs[i].au16[4];
5548	}
5549
5550	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5551	if (rcStrict != VINF_SUCCESS)
5552	return rcStrict;
5553
5554	/*
5555	* Re-initialize the FPU.
5556	*/
5557	pCtx->fpu.FCW = 0x37f;
5558	pCtx->fpu.FSW = 0;
5559	pCtx->fpu.FTW = 0x00; /* 0 - empty */
5560	pCtx->fpu.FPUDP = 0;
5561	pCtx->fpu.DS = 0;
5562	pCtx->fpu.Rsrvd2= 0;
5563	pCtx->fpu.FPUIP = 0;
5564	pCtx->fpu.CS = 0;
5565	pCtx->fpu.Rsrvd1= 0;
5566	pCtx->fpu.FOP = 0;
5567
5568	iemHlpUsedFpu(pIemCpu);
5569	iemRegAddToRip(pIemCpu, cbInstr);
5570	return VINF_SUCCESS;
5571	}
5572
5573
5574
5575	/**
5576	* Implements 'FLDENV'.
5577	*
5578	* @param enmEffOpSize The operand size (only REX.W really matters).
5579	* @param iEffSeg The effective segment register for @a GCPtrEff.
5580	* @param GCPtrEffSrc The address of the image.
5581	*/
5582	IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
5583	{
5584	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5585	RTCPTRUNION uPtr;
5586	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
5587	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
5588	if (rcStrict != VINF_SUCCESS)
5589	return rcStrict;
5590
5591	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5592
5593	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
5594	if (rcStrict != VINF_SUCCESS)
5595	return rcStrict;
5596
5597	iemHlpUsedFpu(pIemCpu);
5598	iemRegAddToRip(pIemCpu, cbInstr);
5599	return VINF_SUCCESS;
5600	}
5601
5602
5603	/**
5604	* Implements 'FRSTOR'.
5605	*
5606	* @param GCPtrEffSrc The address of the image.
5607	* @param enmEffOpSize The operand size.
5608	*/
5609	IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
5610	{
5611	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5612	RTCPTRUNION uPtr;
5613	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
5614	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
5615	if (rcStrict != VINF_SUCCESS)
5616	return rcStrict;
5617
5618	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5619	PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
5620	for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
5621	{
5622	pCtx->fpu.aRegs[i].au32[0] = paRegs[i].au32[0];
5623	pCtx->fpu.aRegs[i].au32[1] = paRegs[i].au32[1];
5624	pCtx->fpu.aRegs[i].au32[2] = paRegs[i].au16[4];
5625	pCtx->fpu.aRegs[i].au32[3] = 0;
5626	}
5627
5628	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
5629	if (rcStrict != VINF_SUCCESS)
5630	return rcStrict;
5631
5632	iemHlpUsedFpu(pIemCpu);
5633	iemRegAddToRip(pIemCpu, cbInstr);
5634	return VINF_SUCCESS;
5635	}
5636
5637
5638	/**
5639	* Implements 'FLDCW'.
5640	*
5641	* @param u16Fcw The new FCW.
5642	*/
5643	IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
5644	{
5645	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5646
5647	/** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
5648	/** @todo Testcase: Try see what happens when trying to set undefined bits
5649	* (other than 6 and 7). Currently ignoring them. */
5650	/** @todo Testcase: Test that it raises and loweres the FPU exception bits
5651	* according to FSW. (This is was is currently implemented.) */
5652	pCtx->fpu.FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
5653	iemFpuRecalcExceptionStatus(pCtx);
5654
5655	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
5656	iemHlpUsedFpu(pIemCpu);
5657	iemRegAddToRip(pIemCpu, cbInstr);
5658	return VINF_SUCCESS;
5659	}
5660
5661
5662
5663	/**
5664	* Implements the underflow case of fxch.
5665	*
5666	* @param iStReg The other stack register.
5667	*/
5668	IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
5669	{
5670	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5671
5672	unsigned const iReg1 = X86_FSW_TOP_GET(pCtx->fpu.FSW);
5673	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
5674	Assert(!(RT_BIT(iReg1) & pCtx->fpu.FTW) \|\| !(RT_BIT(iReg2) & pCtx->fpu.FTW));
5675
5676	/** @todo Testcase: fxch underflow. Making assumptions that underflowed
5677	* registers are read as QNaN and then exchanged. This could be
5678	* wrong... */
5679	if (pCtx->fpu.FCW & X86_FCW_IM)
5680	{
5681	if (RT_BIT(iReg1) & pCtx->fpu.FTW)
5682	{
5683	if (RT_BIT(iReg2) & pCtx->fpu.FTW)
5684	iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
5685	else
5686	pCtx->fpu.aRegs[0].r80 = pCtx->fpu.aRegs[iStReg].r80;
5687	iemFpuStoreQNan(&pCtx->fpu.aRegs[iStReg].r80);
5688	}
5689	else
5690	{
5691	pCtx->fpu.aRegs[iStReg].r80 = pCtx->fpu.aRegs[0].r80;
5692	iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
5693	}
5694	pCtx->fpu.FSW &= ~X86_FSW_C_MASK;
5695	pCtx->fpu.FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF;
5696	}
5697	else
5698	{
5699	/* raise underflow exception, don't change anything. */
5700	pCtx->fpu.FSW &= ~(X86_FSW_TOP_MASK \| X86_FSW_XCPT_MASK);
5701	pCtx->fpu.FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
5702	}
5703
5704	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
5705	iemHlpUsedFpu(pIemCpu);
5706	iemRegAddToRip(pIemCpu, cbInstr);
5707	return VINF_SUCCESS;
5708	}
5709
5710
5711	/**
5712	* Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
5713	*
5714	* @param cToAdd 1 or 7.
5715	*/
5716	IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
5717	{
5718	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5719	Assert(iStReg < 8);
5720
5721	/*
5722	* Raise exceptions.
5723	*/
5724	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
5725	return iemRaiseDeviceNotAvailable(pIemCpu);
5726	uint16_t u16Fsw = pCtx->fpu.FSW;
5727	if (u16Fsw & X86_FSW_ES)
5728	return iemRaiseMathFault(pIemCpu);
5729
5730	/*
5731	* Check if any of the register accesses causes #SF + #IA.
5732	*/
5733	unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
5734	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
5735	if ((pCtx->fpu.FTW & (RT_BIT(iReg1) \| RT_BIT(iReg2))) == (RT_BIT(iReg1) \| RT_BIT(iReg2)))
5736	{
5737	uint32_t u32Eflags = pfnAImpl(&pCtx->fpu, &u16Fsw, &pCtx->fpu.aRegs[0].r80, &pCtx->fpu.aRegs[iStReg].r80);
5738	pCtx->fpu.FSW &= ~X86_FSW_C1;
5739	pCtx->fpu.FSW \|= u16Fsw & ~X86_FSW_TOP_MASK;
5740	if ( !(u16Fsw & X86_FSW_IE)
5741	\|\| (pCtx->fpu.FCW & X86_FCW_IM) )
5742	{
5743	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5744	pCtx->eflags.u \|= pCtx->eflags.u & (X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5745	}
5746	}
5747	else if (pCtx->fpu.FCW & X86_FCW_IM)
5748	{
5749	/* Masked underflow. */
5750	pCtx->fpu.FSW &= ~X86_FSW_C1;
5751	pCtx->fpu.FSW \|= X86_FSW_IE \| X86_FSW_SF;
5752	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5753	pCtx->eflags.u \|= X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF;
5754	}
5755	else
5756	{
5757	/* Raise underflow - don't touch EFLAGS or TOP. */
5758	pCtx->fpu.FSW &= ~X86_FSW_C1;
5759	pCtx->fpu.FSW \|= X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
5760	fPop = false;
5761	}
5762
5763	/*
5764	* Pop if necessary.
5765	*/
5766	if (fPop)
5767	{
5768	pCtx->fpu.FTW &= ~RT_BIT(iReg1);
5769	pCtx->fpu.FSW &= X86_FSW_TOP_MASK;
5770	pCtx->fpu.FSW \|= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
5771	}
5772
5773	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
5774	iemHlpUsedFpu(pIemCpu);
5775	iemRegAddToRip(pIemCpu, cbInstr);
5776	return VINF_SUCCESS;
5777	}
5778
5779	/** @} */
5780

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 47681

Download in other formats: